contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/framework/manager.rb

@@ -3,9 +3,9 @@
 
 cs__scoped_require 'contrast/framework/view_technologies_descriptor'
 cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails_support'
-cs__scoped_require 'contrast/framework/sinatra_support'
+cs__scoped_require 'contrast/framework/rack/support'
+cs__scoped_require 'contrast/framework/rails/support'
+cs__scoped_require 'contrast/framework/sinatra/support'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/class_util'
 
@@ -14,26 +14,51 @@ module Contrast
     # Allows access to framework specific information
     class Manager
       include Contrast::Components::Interface
-      access_component :logging, :analysis
+      access_component :analysis, :logging
 
       # Order here does matter as the first framework listed will be the first one we pull information from
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
       # do not exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::RailsSupport,
-        Contrast::Framework::SinatraSupport
+        Contrast::Framework::Rails::Support,
+        Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Rack::Support
       ].cs__freeze
 
       def initialize
         @_frameworks = SUPPORTED_FRAMEWORKS.map do |framework_klass|
           next unless enable_framework_support?(framework_klass.detection_class)
 
-          logger.debug("Detected framework #{ framework_klass.detection_class } - enabling support")
+          logger.info('Framework detected. Enabling support.', framework: framework_klass.detection_class)
           framework_klass
         end
         @_frameworks.compact!
       end
 
+      # Patches that have to be applied as early as possible to catch calls
+      # that happen prior to the first Request, typically those around
+      # configuration.
+      def before_load_patches!
+        @_before_load_patches ||= begin
+                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
+                                    true
+                                  end
+      end
+
+      # Return all the After Load Patches for all the Frameworks we know, even
+      # if that Framework hasn't been detected.
+      #
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the
+      #   AfterLoadPatches of each framework
+      def find_after_load_patches
+        patches = Set.new
+        SUPPORTED_FRAMEWORKS.each do |framework|
+          framework_patches = framework.after_load_patches
+          patches.merge(framework_patches) if framework_patches && !framework_patches.empty?
+        end
+        patches
+      end
+
       def find_applicable_view_technologies
         scan_views_for_all_frameworks
       end
@@ -56,11 +81,37 @@ module Contrast
         first_framework_result :application_name, 'root'
       end
 
+      def app_root
+        found = first_framework_result :application_root, nil
+        found || ::Rack::Directory.new('').root
+      end
+
+      # If we have 0 or n > 1 frameworks, we need to use the default rack request
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
+      #   and values of this particular Request
+      def retrieve_request env
+        return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
+
+        ::Rack::Request.new(env)
+      end
+
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
+      #   and values of this particular Request
+      # @return [Boolean] true if at least one framework is streaming the response; false if none are streaming
+      def streaming? env
+        result = false
+        @_frameworks.each do |framework|
+          result = framework.streaming?(env)
+          break if result
+        end
+        result
+      end
+
       def get_route_dtm request
         result = nil
         @_frameworks.find do |framework_klass|
           # TODO: RUBY-763 Sinatra::Base#call patch adds the Route report
-          next if framework_klass == Contrast::Framework::SinatraSupport
+          next if framework_klass == Contrast::Framework::Sinatra::Support
 
           result = framework_klass.current_route(request)
         end

data/lib/contrast/framework/platform_version.rb

@@ -6,6 +6,7 @@ module Contrast
     # Used to map version strings from frameworks to ApplicationUpdate dtm
     class PlatformVersion
       attr_reader :major, :minor, :patch
+
       def initialize major, minor, patch
         @major = major || ''
         @minor = minor || ''

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -0,0 +1,126 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Our patch into the Rack::Session::Cookie Class, allowing for the
+        # runtime detection of insecure configurations on individual cookies
+        # within the application
+        class SessionCookie
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_NAME = 'rails-http-only-disabled'
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def instrument
+              @_instrument ||= begin
+                                 ::Rack::Session::Cookie.class_eval do
+                                   alias_method :cs__patched_initialize, :initialize
+                                   def initialize app, options = {}
+                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                                     cs__patched_initialize(app, options)
+                                   end
+                                 end
+                                 true
+                               end
+            end
+
+            def analyze options
+              return unless AGENT.enabled?
+              return if PROTECT.enabled?
+
+              apply_session_timeout(options)
+              apply_httponly(options)
+              apply_secure_session(options)
+            end
+
+            private
+
+            def vulnerable_setting?(setting_key,
+                                    safe_settings_value,
+                                    options, safe_default: true,
+                                    comparison_type: nil)
+              # In most cases, Rack is pretty nice and the default value is safe
+              return !safe_default unless options&.key?(setting_key)
+
+              value = options[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_secure_session options
+              return unless vulnerable_setting?(
+                  :secure,
+                  true,
+                  options,
+                  safe_default: false)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SECURE_RULE_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to secure session', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_session_timeout options
+              return unless vulnerable_setting?(:expire_after,
+                                                SAFE_SESSION_TIMEOUT,
+                                                options,
+                                                safe_default: false,
+                                                comparison_type: :greater_than)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SESSION_TIMEOUT_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly options
+              return unless vulnerable_setting?(:httponly, true, options)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__HTTPONLY_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to httponly', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rack/patch/support.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rack framework.
+        module Support
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                'Rack::Session::Cookie',
+                'contrast/framework/rack/patch/session_cookie',
+                instrumenting_module: 'Contrast::Framework::Rack::Patch::SessionCookie')])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rack/support.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/rack/patch/support'
+
+module Contrast
+  module Framework
+    module Rack
+      # Used when Rack is present to define framework specific behavior. For
+      # now, the only part of this implemented is the Patch Support.
+      class Support < BaseSupport
+        extend Contrast::Framework::Rack::Patch::Support
+        class << self
+          def detection_class
+            'don\'t let me be detected'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -0,0 +1,43 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/service_sender_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This class acts as our patch into the ActionController::Live::Buffer
+        # class, allowing us to track the close event on streamed responses.
+        class ActionControllerLiveBuffer
+          class << self
+            def send_messages
+              return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+              [context.server_activity, context.activity, context.observed_route].each do |msg|
+                Contrast::Utils::ServiceSenderUtil.send_event_immediately(msg)
+              end
+            end
+
+            def instrument
+              @_instrument ||= begin
+                                 ::ActionController::Live::Buffer.class_eval do
+                                   # normally pre->in->post filters are applied however, in a streamed response
+                                   # we can run into a case where it's pre -> in -> post -> more infilters
+                                   # in order to submit anything found during the infilters after the response has
+                                   # been written we need to explicitly send them
+                                   alias_method :cs__close, :close
+                                   def close
+                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                                     cs__close
+                                   end
+                                 end
+                                 true
+                               end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -0,0 +1,103 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/invalid_configuration_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This module is used to analyze rails session storage configuration for assess vulnerabilities
+        module AssessConfiguration
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
+
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def analyze_session_store *args
+              return unless AGENT.enabled?
+              return if PROTECT.enabled?
+
+              apply_httponly_disabled(*args)
+              apply_secure_cookie_disabled(*args)
+              apply_session_timeout(*args)
+            end
+
+            private
+
+            def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
+              # In most cases, Rails is pretty nice and the default value is safe
+              return !safe_default unless original_args && original_args.length > 1
+
+              # If the user overrode some args, but not ours, fall back on the default
+              rails_session_settings = original_args[1]
+              return !safe_default unless rails_session_settings&.key?(setting_key)
+
+              value = rails_session_settings[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_session_timeout *args
+              return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
+              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_secure_cookie_disabled *args
+              return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
+              return unless vulnerable_setting?(:secure, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable secure cookies', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly_disabled *args
+              return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
+              return unless vulnerable_setting?(:httponly, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable httponly in session cookie', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Our patch into the Rails::Application::Configuration Class, allowing
+        # for the runtime detection of insecure configurations on individual
+        # ActionDispatch::Session::AbstractStore instances within the
+        # application.
+        class RailsApplicationConfiguration
+          def self.instrument
+            @_instrument ||= begin
+                               ::Rails::Application::Configuration.class_eval do
+                                 alias_method :cs__patched_session_store, :session_store
+                                 def session_store *args
+                                   ret = cs__patched_session_store(*args)
+                                   Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                                   ret
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end