contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -15,12 +15,10 @@ module Contrast
           JSON_GOOD_VALUE = 'good_value'
           JSON_DISALLOWED_TAGS = 'disallowed_tags'
           JSON_REQUIRED_TAGS = 'required_tags'
-          JSON_NODES = 'nodes'
           JSON_RULE_NAME = 'name'
           JSON_CUSTOM_PATCH = 'custom_patch'
 
-          attr_reader :rule_id
-          attr_accessor :required_tags, :disallowed_tags, :good_value, :bad_value
+          attr_reader :rule_id, :required_tags, :disallowed_tags, :good_value, :bad_value
 
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)
@@ -45,8 +43,8 @@ module Contrast
             TRIGGER
           end
 
-          def apply_custom_trigger context, trigger_node, source, object, ret, invoked, *args
-            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, invoked, *args)
+          def apply_custom_trigger context, trigger_node, source, object, ret, *args
+            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, *args)
           end
 
           def custom_trigger_class
@@ -161,7 +159,6 @@ module Contrast
             @disallowed_tags << VALIDATOR_START + loud_name
           end
 
-          ENCODED_MARKER = '_ENCODED'
           def validate_rule_tags tags
             return unless tags
 

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -32,43 +32,14 @@ module Contrast
 
               # It is dangerous for the user to control a section of the URL
               # between the start of the protocol and the beginning of the
-              # querystring. If there is no querystring, then the entire URL is
+              # querystring. If there is no path, then the entire URL is
               # dangerous for the User to control.
               start = match.begin(:protocol)
-              finish = match.begin(:query_string)
+              finish = match.begin(:path)
               finish ||= url.length
 
               args[0].cs__properties.any_tags_between?(start, finish)
             end
-
-            # Some SSRF triggers take multiple parameters to build the URL.
-            # For the net_http_# sources, if the first parameter is a String,
-            # the URL is built by appending the first and second parameters.
-            def self.composite? patcher, args
-              id = patcher.id.to_s
-              return false unless id.start_with?(PATH_ONLY_PATCH_MARKER)
-
-              args[0].is_a?(String)
-            end
-
-            def self.build_single_source args
-              return nil unless args[0].cs__respond_to?(:cs__properties)
-
-              args[0].to_s
-            end
-
-            def self.build_composite_source args
-              if args.length > 1
-                return nil unless args[0].cs__respond_to?(:cs__properties) ||
-                    args[1].cs__respond_to?(:cs__properties)
-
-                args[0] + args[1]
-              else
-                return nil unless args[0].cs__respond_to?(:cs__properties)
-
-                args[0].to_s
-              end
-            end
           end
         end
       end

data/lib/contrast/agent/assess/properties.rb

@@ -5,7 +5,8 @@ cs__scoped_require 'set'
 cs__scoped_require 'base64'
 cs__scoped_require 'contrast/utils/prevent_serialization'
 cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/agent/assess/events/event_factory'
+cs__scoped_require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent
@@ -285,8 +286,8 @@ module Contrast
           self
         end
 
-        def build_event policy_node, tagged, object, ret, args, invoked = 0, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args, invoked, source_type, source_name)
+        def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+          event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
           add_event(event)
           report_sources(tagged, event)
         end
@@ -295,6 +296,7 @@ module Contrast
 
         def report_sources tagged, event
           return unless tagged && !tagged.to_s.empty?
+          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
           return unless event&.source_type
 
           current_request = Contrast::Agent::REQUEST_TRACKER.current

data/lib/contrast/agent/assess/rule/base.rb

@@ -13,7 +13,7 @@ module Contrast
         # The base class for each of our Assess Rules
         class Base
           include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :settings
+          access_component :agent, :analysis, :logging, :settings
 
           def initialize
             SETTINGS.assess_rules[name] = self
@@ -61,10 +61,6 @@ module Contrast
           def generate_hash finding
             Contrast::Utils::HashDigest.generate_trigger_hash(finding)
           end
-
-          def trace_tags
-            @_trace_tags ||= ASSESS.tags.to_s
-          end
         end
       end
     end

data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb

@@ -16,9 +16,7 @@ module Contrast
           # token.
           class CsrfApplicator
             include Contrast::Components::Interface
-            access_component :logging, :analysis, :scope
-
-            CS__CSRF_LOG_MSG = 'applying CSRF assess rule'
+            access_component :analysis, :logging, :scope
 
             class << self
               def csrf_tagger patcher, preshift, _ret, _block
@@ -32,30 +30,12 @@ module Contrast
                 return unless sql
 
                 with_contrast_scope do
-                  logger.debug(nil, CS__CSRF_LOG_MSG)
                   rule.record_db_state_change(
                       Contrast::Agent::REQUEST_TRACKER.current,
                       sql)
                 end
-              end
-
-              def apply_csrf_rule sql
-                context = Contrast::Agent::REQUEST_TRACKER.current
-
-                return unless context&.app_loaded?
-                return unless ASSESS.enabled?
-                return unless sql
-
-                rule = Contrast::Agent::FeatureState.instance.assess_rule(
-                    Contrast::Agent::Assess::Rule::Csrf::NAME)
-                return unless rule&.enabled?
-
-                with_contrast_scope do
-                  logger.debug(CS__CSRF_LOG_MSG)
-                  rule.record_db_state_change(context, sql)
-                end
               rescue StandardError => e
-                logger.warn(e, 'Error running CSRF assess rule')
+                logger.warn('Error running CSRF assess rule', e)
               end
 
               private

data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
+cs__scoped_require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -12,6 +13,9 @@ module Contrast
           # This one is used by the CSRF rule to determine if a request was
           # made in a way that is susceptible to a CSRF attack.
           class Watcher < Contrast::Agent::Assess::Rule::ResponseWatcher
+            include Contrast::Components::Interface
+            access_component :logging
+
             def supports? context
               return false unless super(context)
               return false unless user_agent?(context)
@@ -122,7 +126,7 @@ module Contrast
               finding.properties[DATA_KEY] = Contrast::Utils::StringUtils.force_utf8(string)
               finding
             rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for CSRF')
+              logger.error('Unable to build a finding for CSRF', e)
             end
           end
         end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -19,7 +19,7 @@ module Contrast
           # 4) redacted_marker : the value to plug in for the obfuscated value
           module HardcodedValueRule
             include Contrast::Components::Interface
-            access_component :contrast_service, :logging, :analysis
+            access_component :analysis, :contrast_service, :logging
 
             def disabled?
               !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
@@ -111,7 +111,7 @@ module Contrast
 
               CONTRAST_SERVICE.queue_message activity
             rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for Hardcoded Rule')
+              logger.error('Unable to build a finding for Hardcoded Rule', e)
             end
           end
         end

data/lib/contrast/agent/assess/rule/redos.rb

@@ -17,7 +17,7 @@ module Contrast
               NAME
             end
 
-            def regexp_complexity_check context, trigger_node, source, object, ret, invoked, *args
+            def regexp_complexity_check context, trigger_node, source, object, ret, *args
               # we can arrive here either from:
               #   regexp =~ string
               #   string =~ regexp
@@ -31,9 +31,9 @@ module Contrast
               return unless regexp_vulnerable?(regexp)
 
               # (2) regexp must evaluate against user input
-              if trigger_node.violated?(string) # rubocop:disable Style/GuardClause
-                Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, invoked + 1, args)
-              end
+              return unless trigger_node.violated?(string)
+
+              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, args)
             end
 
             protected

data/lib/contrast/agent/assess/tag.rb

@@ -33,6 +33,10 @@ module Contrast
           start_idx...end_idx
         end
 
+        def extends_beyond_string_size? string_length
+          @end_idx > string_length
+        end
+
         # Return if a given tag overlaps this one
         def overlaps? other
           return true if @start_idx <  other.start_idx && @end_idx >= other.start_idx  # we start below other & end in it
@@ -100,27 +104,33 @@ module Contrast
         # The tag is ______ the range
         # rrrrrrr == self.range, the range of the tag
         def compare_range start, stop
-          # r starts and stops below
-          # rrrrrrrrrrrrr
-          #               start       stop
-          return BELOW     if @start_idx <  start && @end_idx <= start
-          # r starts below and finishes within
-          # rrrrrrrrrrrrr
-          #    start       stop
-          return LOW_SPAN  if @start_idx <  start && @end_idx > start && @end_idx <= stop
+          # the range starts below the given values
+          if @start_idx < start
+            # r starts and stops below
+            # rrrrrrrrrrrrr
+            #               start       stop
+            return BELOW if @end_idx <= start
+            # r starts below and finishes within
+            # rrrrrrrrrrrrr
+            #    start       stop
+            return LOW_SPAN if @end_idx > start && @end_idx <= stop
+            # r starts below and finishes above stop
+            #  rrrrrrrrrrrrrrrrrrrrrrrr
+            #     start       stop
+            return WITHOUT if @end_idx > stop
+          end
+
+          # the range starts at or above the given values
           # r is between start and stop
           #        rrrrrrrrrrrrrrr
           # start                   stop
-          return WITHIN    if @start_idx >= start && @start_idx < stop && @end_idx <= stop
-          # r starts below and finishes above stop
-          #  rrrrrrrrrrrrrrrrrrrrrrrr
-          #     start       stop
-          return WITHOUT   if @start_idx <  start && @end_idx > stop
+          return WITHIN if @start_idx < stop && @end_idx <= stop
           # r starts within and finishes above stop
           #           rrrrrrrrrrrrr
           #   start       stop
-          return HIGH_SPAN if @start_idx >= start && @start_idx < stop && @end_idx > stop
+          return HIGH_SPAN if @start_idx < stop && @end_idx > stop
 
+          # the range is above the given values
           # starts and stops above
           #                   rrrrrrrrrrrrr
           #  start       stop

data/lib/contrast/agent/at_exit_hook.rb

@@ -8,26 +8,29 @@ module Contrast
     # This module adds an at_exit hook for us to send messages that may be lost at process exit
     module AtExitHook
       include Contrast::Components::Interface
-      access_component :logging, :contrast_service
-
-      TERMINATION_NOTICE = 'at_exit invoked, host application terminating'
-
+      access_component :contrast_service, :logging
       def self.exit_hook
         @_exit_hook ||= begin
                           at_exit do
-                            logger.debug(TERMINATION_NOTICE)
-
-                            context = Contrast::Agent::REQUEST_TRACKER.current
-                            CONTRAST_SERVICE.send_message(context.activity) if context
-
-                            logger.debug(" - current PID  #{ @pid  }")
-                            logger.debug(" - current PPID #{ @ppid }")
-                            logger.debug(" - process PID  #{ Process.pid  }")
-                            logger.debug(" - process PPID #{ Process.ppid }")
+                            on_exit
                           end
                           true
                         end
       end
+
+      # Actions to take when a process exits. Typically called from our
+      # exit_hook, but exposed here for other process terminations, like those
+      # in Kernel#exec
+      def self.on_exit
+        logger.debug('at_exit invoked, host application terminating',
+                     p_id: @pid,
+                     pp_id: @ppid,
+                     process_pid: Process.pid,
+                     process_pp_id: Process.ppid)
+
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        CONTRAST_SERVICE.send_message(context.activity) if context
+      end
     end
   end
 end

data/lib/contrast/agent/class_reopener.rb

@@ -27,8 +27,7 @@ end
 
 module Contrast
   module Agent
-    # Used for Ruby 2.4 & 2.5 to allow us to rewrite those methods which have
-    # interpolation in them.
+    # TODO: RUBY-714 remove w/ EOL of 2.5
     # @deprecated Changes to this class are discouraged as this approach is
     #   being phased out with support for those language versions.
     class ClassReopener
@@ -116,9 +115,7 @@ module Contrast
       def source_code location, method_name
         file_name = location[0]
         line_number = location[1]
-        return unless file_name && line_number
-        return unless File.exist?(file_name) && File.readable?(file_name)
-        return if File.empty?(file_name)
+        return unless file_contents_available?(file_name, line_number)
 
         files[file_name] = File.readlines(file_name) unless files.key?(file_name)
         lines = files[file_name]
@@ -131,7 +128,11 @@ module Contrast
           break if complete?(code)
         end
         unless complete?(code) && compiles?(code)
-          logger.warn("Failed to capture #{ method_name } in #{ file_name } at #{ line_number } for rewriting.")
+          logger.warn(
+              'Failed to determine sourcecode for rewriting.',
+              file: file_name,
+              method: method_name,
+              line_number: line_number)
           return
         end
         code
@@ -139,6 +140,14 @@ module Contrast
 
       private
 
+      def file_contents_available? file_name, line_number
+        return false unless file_name && line_number
+        return false unless File.exist?(file_name) && File.readable?(file_name)
+        return false if File.empty?(file_name)
+
+        true
+      end
+
       def gather_modules
         return if class_module_path.nil?
 

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -37,14 +37,14 @@ module Contrast
 
           def add_node node, _node_type = :deadzones
             unless node
-              logger.error(nil, 'Node was nil when adding node to policy')
+              logger.error('Node was nil when adding node to policy')
               return
             end
 
             begin
               node.validate
             rescue ArgumentError => e
-              logger.error(e, e.message)
+              logger.error('Node failed validation', e)
               return
             end
 

data/lib/contrast/agent/disable_reaction.rb

@@ -10,13 +10,12 @@ module Contrast
     # set by the Organization's Administrator
     class DisableReaction
       include Contrast::Components::Interface
-      access_component :logging, :agent
+      access_component :agent, :logging
 
       def self.run _reaction, level
         logger.with_level(
-            nil,
-            'Contrast received instructions to disable itself - Disabling now',
-            level)
+            level,
+            'Contrast received instructions to disable itself - Disabling now')
         AGENT.disable!
       end
     end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/api/decorators/exclusion.rb'
 
 module Contrast
   module Agent
@@ -12,6 +13,10 @@ module Contrast
       include Contrast::Components::Interface
       access_component :logging
 
+      # Create a matcher around an exclusion sent from TeamServer.
+      #
+      # @param excl [Contrast::Api::Settings::Exclusion]
+      # @return [Contrast::Agent::ExclusionMatcher]
       def initialize excl
         @exclusion = excl
         @protect = @exclusion.protect
@@ -58,10 +63,10 @@ module Contrast
       # Contrast UI, these comparisons must be done at the end of the input.
       # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
       def handle_wildcard_code
-        return unless @exclusion.blacklist&.any?
+        return unless @exclusion.denylist&.any?
 
         @wildcard_exclusions = []
-        @exclusion.blacklist.each do |code|
+        @exclusion.denylist.each do |code|
           class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
           class_pattern = build_regexp(class_name, false, true)
           method_pattern = build_regexp(method_name)
@@ -76,7 +81,7 @@ module Contrast
         pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
         Regexp.compile(pattern)
       rescue RegexpError => e
-        logger.error(e, "Unable to generate a pattern for #{ pattern }. It will not be used for exclusion matching.")
+        logger.error('Unable to generate a pattern for exclusion matching.', e, pattern: pattern)
       end
 
       def protect?
@@ -87,14 +92,6 @@ module Contrast
         @assess
       end
 
-      def url?
-        @exclusion.type == :URL
-      end
-
-      def input?
-        @exclusion.type == :INPUT
-      end
-
       def code?
         @exclusion.type == :CODE
       end
@@ -131,43 +128,6 @@ module Contrast
             )
       end
 
-      def match_url? url
-        return false unless url?
-        return true if @wildcard_url
-
-        @urls.any? { |test| url.match?(test) }
-      end
-
-      def match_input? value, type
-        return false unless input?
-
-        exclusion_type = @exclusion.input_type
-        case type
-        when :PARAMETER_NAME, :PARAMETER_VALUE
-          return exclusion_type == :PARAMETER && value_match?(value)
-        when :COOKIE_NAME, :COOKIE_VALUE
-          return exclusion_type == :COOKIE && value_match?(value)
-        when :HEADER
-          return exclusion_type == :HEADER && value_match?(value, false)
-        when :BODY
-          return exclusion_type == :BODY
-        when :QUERYSTRING
-          return exclusion_type == :QUERYSTRING
-        end
-
-        false
-      end
-
-      def value_match? value, case_sensitive = true
-        return true if @wildcard_input
-
-        if case_sensitive
-          value == @exclusion.input_name
-        else
-          @exclusion.input_name.casecmp(value).zero?
-        end
-      end
-
       def match_code? stack_trace
         return false unless code?
         return false if @wildcard_exclusions&.empty?