contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/components/inventory.rb

@@ -11,9 +11,13 @@ module Contrast
       # product.
       class Interface
         include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :config
 
         def enabled?
-          state.inventory_enabled?
+          @_enabled = !false?(CONFIG.root.inventory.enable) if @_enabled.nil?
+          @_enabled
         end
       end
 

data/lib/contrast/components/logger.rb

@@ -1,12 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/logger/log'
+
 module Contrast
   module Components
     module Logger
       module InstanceMethods #:nodoc:
         def logger
-          Contrast::Components::Logger::COMPONENT_INTERFACE
+          Contrast::Logger::Log.instance.logger
         end
       end
       ClassMethods = InstanceMethods
@@ -17,73 +19,6 @@ module Contrast
       # Specifically, this allows for querying the state of the Agent Logger.
       class Interface
         include Contrast::Components::ComponentBase
-
-        %w[error? warn? info? debug?].each do |level|
-          define_method(level) { state.logger.send(level) }
-        end
-
-        # def trace? # TODO: RUBY-547
-        #  config&.agent&.logger&.level && config.agent.logger.level.to_s.casecmp('TRACE').to_i.zero?
-        # end
-
-        def error *args
-          log_with_level(*args, :error)
-        end
-
-        def warn *args
-          log_with_level(*args, :warn)
-        end
-
-        def info *args
-          log_with_level(*args, :info)
-        end
-
-        def debug *args
-          log_with_level(*args, :debug)
-        end
-
-        def with_level *args
-          log_with_level(*args)
-        end
-
-        def debug_with_time msg
-          ret = nil
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        # def trace_with_time msg # TODO: RUBY-547
-        #  ret = nil
-        #  unless trace?
-        #    ret = yield if block_given?
-        #    return ret
-        #  end
-        #
-        #  a = Contrast::Utils::Timer.now_ms
-        #  ret = yield if block_given?
-        #  z = Contrast::Utils::Timer.now_ms
-        #  log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-        #  ret
-        # end
-
-        private
-
-        def log_with_level *args
-          if args.length == 2
-            msg, level = *args
-            state.cs__class.log_with_level(nil, msg, level)
-          elsif args.length == 3
-            exception, msg, level = *args
-            state.cs__class.log_with_level(exception, msg, level)
-          end
-
-          nil
-        rescue StandardError
-          nil
-        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/protect.rb

@@ -13,23 +13,59 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :settings
+        access_component :config, :settings
 
         def enabled?
-          state.protect_enabled?
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
+
+          SETTINGS.protect_enabled?
         end
 
-        def forcibly_disabled?
-          state.protect_forcibly_disabled?
+        def rule_config
+          CONFIG.root.protect.rules
         end
 
         def rules
           SETTINGS.protect_rules
         end
 
+        def rule_mode rule_id
+          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+        end
+
         def rule name
           SETTINGS.protect_rules[name]
         end
+
+        def report_any_command_execution?
+          if @_report_any_command_execution.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::CmdInjection::NAME]
+            @_report_any_command_execution = true?(ctrl.disable_system_commands)
+          end
+          @_report_any_command_execution
+        end
+
+        def report_custom_code_sysfile_access?
+          if @_report_custom_code_sysfile_access.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::PathTraversal::NAME]
+            @_report_custom_code_sysfile_access = true?(ctrl.detect_custom_code_accessing_system_files)
+          end
+          @_report_custom_code_sysfile_access
+        end
+
+        def forcibly_disabled?
+          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled
+        end
+
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/sampling.rb

@@ -9,7 +9,7 @@ module Contrast
         DEFAULT_SAMPLING_BASELINE           = 5
         DEFAULT_SAMPLING_REQUEST_FREQUENCY  = 5
         DEFAULT_SAMPLING_RESPONSE_FREQUENCY = 25
-        DEFAULT_SAMPLING_WINDOW_MS          = 180_000 # 3 minutes, arbitrary value from Java agent
+        DEFAULT_SAMPLING_WINDOW_MS          = 180_000
       end
 
       module ClassMethods #:nodoc:
@@ -17,18 +17,29 @@ module Contrast
         include Constants
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :config, :settings
 
-        def sampling_control settings = @sampling_features
-          cas = CONFIG.root.assess&.sampling
+        def sampling_enabled?
+          sampling_control[:enabled]
+        end
+
+        def sampling_control
+          @_sampling_control ||= begin
+            cas = CONFIG.root.assess&.sampling
+            settings = SETTINGS&.assess_state&.[](:sampling_settings)
+            {
+                enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0]),
+                baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?),
+                request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?),
+                response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
+                window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+            }
+          end
+        end
 
-          {
-              enabled: [cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED] .reject(&:nil?).first,
-              baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE] .map(&:to_i).find(&:positive?),
-              request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY] .map(&:to_i).find(&:positive?),
-              response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-              window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS] .map(&:to_i).find(&:positive?)
-          }
+        # Used to reset sampling when settings from TeamServer change
+        def reset_sampling_control
+          @_sampling_control = nil
         end
       end
 

data/lib/contrast/components/scope.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
 cs__scoped_require 'fiber'
+cs__scoped_require 'monitor'
 cs__scoped_require 'contrast/agent/scope'
 
 # This is the Scope component.
@@ -54,7 +54,7 @@ module Contrast
           end
         end
 
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
+        # TODO: RUBY-572
         #
         # Current behavior is to no-op if we're not "in a request context".
         # Our C functions were previously checking to see if we had a scope, because
@@ -84,53 +84,3 @@ module Contrast
     end
   end
 end
-
-# This is a reasonable place for the Kernel#catch hook to live.
-# No current plans for component re-design, but if we had some kind of
-# "do this when a component is hooked in" thing, this would live there.
-# For now, it's over-engineering to live anywhere else.  -ajm
-module Kernel # :nodoc:
-  alias_method :cs__catch, :catch
-
-  # In the event of a `throw`, we need to override `catch`
-  # to save & restore scope state:
-  #
-  #   scope_level == 0
-  #
-  #   catch(:abc) do
-  #     with_contrast_scope do
-  #       throw :abc # will leak
-  #     end
-  #   end
-  #
-  #   scope_level == 1
-  #
-  # Frankly, this isn't how scope should be used.  This is in place of
-  # proper `ensure` blocks within the instrumentation call stack.
-  # This will actually /create/ scope leaks if you're doing something like:
-  #
-  #   catch(:ohno) do
-  #     enter scope
-  #   end
-  #
-  #   abc()
-  #
-  #   exit scope
-  #
-  # i.e. if you intend to change net scope across a catch block boundary.
-
-  private
-
-  def catch *args, &block
-    # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
-
-    # Run original catch with block.
-    retval = cs__catch(*args, &block)
-
-    # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
-
-    retval
-  end
-end

data/lib/contrast/components/settings.rb

@@ -23,11 +23,6 @@ module Contrast
         # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
 
-        # a vulnerability like padding oracle is exploited across
-        # multiple requests, as a timing attack.  these attempts must be
-        # accumulated, in order to recognize the pattern and block the attack.
-        attr_reader :accumulator_settings
-
         # These three 'state' variables represent atomic config/setting state,
         # outside of things like rule defs.
 
@@ -40,8 +35,7 @@ module Contrast
 
         def protect_state
           @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
+              enabled: false
           }
         end
 
@@ -58,8 +52,7 @@ module Contrast
         # So, between this block and rules, that's setting state.
         PROTECT_STATE_ATTRS       = %i[].cs__freeze
         ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
-        STATE_ATTRS               = PROTECT_STATE_ATTRS | ASSESS_STATE_ATTRS | APPLICATION_STATE_ATTRS
+        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
 
         # Meta-define an accessor for each state attribute.
         begin
@@ -82,10 +75,50 @@ module Contrast
           end
         end
 
+        def session_id
+          # TODO: RUBY-900 we shouldn't send things w/o having session id,
+          #   figure out how this happened and fix it.
+          application_state[:session_id] || Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
         def initialize
           reset_state
         end
 
+        def protect_enabled?
+          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
+          @_protect_enabled
+        end
+
+        def assess_enabled?
+          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
+          @_assess_enabled
+        end
+
+        def code_exclusions
+          exclusion_matchers.select(&:code?)
+        end
+
+        def update_from_server_features server_features
+          # protect
+          begin
+            @_protect_enabled = nil
+            protect_state[:enabled] = server_features.protect_enabled?
+          end
+
+          # assess
+          begin
+            @_assess_enabled = nil
+            assess_state[:enabled] = server_features.assess_enabled?
+            assess_state[:sampling_settings] = server_features.assess.sampling
+            Contrast::Utils::Assess::SamplingUtil.instance.update
+          end
+        end
+
+        def update_from_application_settings application_settings
+          application_state.merge!(application_settings.application_state_translation)
+        end
+
         # Wipe state to zero.
         def reset_state
           @assess_rules = {}
@@ -101,7 +134,6 @@ module Contrast
         def build_assess_rules
           @assess_rules = {}
 
-          Contrast::Agent::Assess::Rule::Csrf.new
           Contrast::Agent::Assess::Rule::Redos.new
         end
 
@@ -118,19 +150,6 @@ module Contrast
           Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
           Contrast::Agent::Protect::Rule::Xss.new
           Contrast::Agent::Protect::Rule::Xxe.new
-
-          # Beta Rules
-          Contrast::Agent::Protect::Rule::Csrf.new
-        end
-
-        def protect_rule name
-          @protect_rules[name]
-        end
-
-        # these are less 'settings' and more 'how do I behave.'
-        # relocate to Agent or Assess/Protect.
-        def protect_rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
         end
       end
 

data/lib/contrast/config/base_configuration.rb

@@ -15,6 +15,7 @@ module Contrast
       BOOLEANS = [true, false].cs__freeze
 
       attr_reader :map
+
       alias_method :to_hash, :map
       def_delegators :@map, :empty?, :key?,
                      :delete,

data/lib/contrast/config/default_value.rb

@@ -8,6 +8,7 @@ module Contrast
     # explicitly to false.
     class DefaultValue
       attr_reader :value
+
       def initialize value
         @value = value
       end

data/lib/contrast/config/protect_rule_configuration.rb

@@ -8,12 +8,6 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # rule mode of a single protect rule in the Agent.
     class ProtectRuleConfiguration < BaseConfiguration
-      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
-      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-
       KEYS = {
           enable: EMPTY_VALUE,
           mode: EMPTY_VALUE,
@@ -24,14 +18,6 @@ module Contrast
       def initialize hsh
         super(hsh, KEYS)
       end
-
-      def off?
-        mode == 'off'
-      end
-
-      def on?
-        !off?
-      end
     end
   end
 end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -14,7 +14,6 @@ module Contrast
           'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
           'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
           'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
           xxe: Contrast::Config::ProtectRuleConfiguration,
           'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
           'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,