contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Trigger
+          # This acts a trigger to handle the special cases of the XPath
+          # library gem and the Oga gem. Untrusted data may come into the
+          # trigger methods from these classes as an array or hash,
+          # respectively. Since untrusted user input comes into these triggers
+          # as a splat argument or an options hash, we need to iterate through
+          # these objects to see if we were tracking on any of them and report
+          # a finding if so.
+          class Xpath
+            include Contrast::Components::Interface
+
+            class << self
+              def xpath_expression_trigger context, trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                process(context, trigger_node, object, ret, *args)
+              end
+
+              def xpath_oga_trigger context, trigger_node, _source, object, ret, *args
+                return ret unless args
+
+                # convert the options arg in Oga::XML::CharacterNode#initialize into an
+                # array of its values so we can check if any are unsafe
+                args = args.first.values if args.first.cs__is_a?(Hash)
+                process(context, trigger_node, object, ret, *args)
+              end
+
+              private
+
+              def process context, trigger_node, object, ret, *args
+                args.each do |arg|
+                  next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
+                  next unless arg.cs__tracked?
+                  next unless trigger_node.violated?(arg)
+
+                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
+                      context, trigger_node, arg, object, ret, args)
+                end
+
+                ret
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -3,8 +3,8 @@
 
 cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/utils/sha256_builder'
+cs__scoped_require 'contrast/agent/assess/events/event_factory'
 cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
-
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
@@ -18,7 +18,7 @@ module Contrast
         # it was not, a Finding report is issued to the Service
         module TriggerMethod
           include Contrast::Components::Interface
-          access_component :logging, :analysis
+          access_component :analysis, :logging, :settings
 
           # The level of TeamServer compliance our traces meet
           CURRENT_FINDING_VERSION = 2
@@ -47,7 +47,6 @@ module Contrast
                                 source,
                                 object,
                                 ret,
-                                1,
                                 *args)
                 end
               else
@@ -56,13 +55,12 @@ module Contrast
                               nil,
                               object,
                               ret,
-                              1,
                               *args)
               end
             end
 
-            def apply_eval_trigger context, trigger_node, source, object, ret, invoked, *args
-              apply_trigger(context, trigger_node, source, object, ret, invoked, *args)
+            def apply_eval_trigger context, trigger_node, source, object, ret, *args
+              apply_trigger(context, trigger_node, source, object, ret, *args)
             end
 
             # This converts the source of the finding, and the events leading
@@ -75,14 +73,12 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
             # @return [Contrast::Api::Dtm::Finding, nil] the
             #   Contrast::Api::Dtm::Finding to send to TeamServer or nil if
             #   conditions were not met
-            def build_finding context, trigger_node, source, object, ret, invoked, *args
+            def build_finding context, trigger_node, source, object, ret, *args
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
               request = context.request
@@ -93,27 +89,26 @@ module Contrast
 
               finding = Contrast::Api::Dtm::Finding.new
               finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+              finding.session_id = SETTINGS.session_id
               finding.version = CURRENT_FINDING_VERSION
 
               build_from_source(finding, source)
-              trigger_event = Contrast::Agent::Assess::ContrastEvent.new(trigger_node, source, object, ret, args, invoked + 1).to_dtm_event
+              trigger_event = Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret, args).to_dtm_event
               finding.events << trigger_event
               build_hash(finding, source)
               build_tags(context)
               finding.routes << context.route if context.route
               context.activity.findings << finding
-              logger.debug(nil, "Trigger #{ trigger_node.id } detected: #{ source.__id__ } triggered #{ trigger_node.rule_id }")
+              logger.trace('Finding created',
+                           node_id: trigger_node.id,
+                           source_id: source.__id__,
+                           rule: trigger_node.rule_id)
             rescue StandardError => e
-              logger.error(e, "Unable to build a finding for #{ trigger_node.id }")
+              logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
 
             private
 
-            def settings
-              Contrast::Agent::FeatureState.instance
-            end
-
             # This is our method that actually checks the taint on the object
             # our trigger_node targets.
             #
@@ -124,27 +119,24 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_trigger context, trigger_node, source, object, ret, invoked, *args
+            def apply_trigger context, trigger_node, source, object, ret, *args
               return unless context && trigger_node
               return if trigger_node.rule_disabled?
               return if trigger_node.dataflow? && source.nil?
 
-              invoked += 1
               if trigger_node.regexp_rule?
-                apply_regexp_rule(context, trigger_node, source, object, ret, invoked, *args)
+                apply_regexp_rule(context, trigger_node, source, object, ret, *args)
               elsif trigger_node.custom_trigger?
-                trigger_node.apply_custom_trigger(context, trigger_node, source, object, ret, invoked, *args)
+                trigger_node.apply_custom_trigger(context, trigger_node, source, object, ret, *args)
               elsif trigger_node.dataflow?
-                apply_dataflow_rule(context, trigger_node, source, object, ret, invoked, *args)
+                apply_dataflow_rule(context, trigger_node, source, object, ret, *args)
               else # trigger rule - just calling the method is dangerous
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
+                build_finding(context, trigger_node, source, object, ret, *args)
               end
             rescue StandardError => e
-              logger.warn(e, 'Unable to apply trigger.')
+              logger.warn('Unable to apply trigger', e, node_id: trigger_node.id)
             end
 
             # Given the marker from the trigger_node (the pointer indicating
@@ -196,17 +188,14 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_regexp_rule context, trigger_node, source, object, ret, invoked, *args
+            def apply_regexp_rule context, trigger_node, source, object, ret, *args
               return unless source.is_a?(String)
               return if trigger_node.good_value && source.match?(trigger_node.good_value)
               return if trigger_node.bad_value && source !~ trigger_node.bad_value
 
-              invoked += 1
-              build_finding(context, trigger_node, source, object, ret, invoked, *args)
+              build_finding(context, trigger_node, source, object, ret, *args)
             end
 
             # This is our method that actually checks the taint on the object
@@ -219,35 +208,31 @@ module Contrast
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
             # @param args [Array<Object>] the Arguments with which the method
             #   was invoked
-            def apply_dataflow_rule context, trigger_node, source, object, ret, invoked, *args
+            def apply_dataflow_rule context, trigger_node, source, object, ret, *args
               return unless source
 
-              invoked += 1
               if Contrast::Utils::DuckUtils.quacks_to?(source, :cs__properties)
                 return unless source.cs__tracked?
                 return unless trigger_node.violated?(source)
 
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
+                build_finding(context, trigger_node, source, object, ret, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(source)
-                invoked += 2 # the each & the block
                 source.each_pair do |key, value|
-                  apply_dataflow_rule(context, trigger_node, key, object, ret, invoked, *args)
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
+                  apply_dataflow_rule(context, trigger_node, key, object, ret, *args)
+                  apply_dataflow_rule(context, trigger_node, value, object, ret, *args)
                 end
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(source)
-                invoked += 2 # the each & the block
                 source.each do |value|
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
+                  apply_dataflow_rule(context, trigger_node, value, object, ret, *args)
                 end
               else
-                logger.warn(
-                    nil,
-                    "Target is a #{ source.cs__class.name } -- not sure how to inspect: #{ trigger_node.inspect }")
-                logger.debug(nil, source.to_s[0..99])
+                logger.warn('Trigger source is of unknown type. Unable to inspect.',
+                            node_id: trigger_node.id,
+                            source_id: target.__id__,
+                            source_type: source.cs__class.to_s)
+                logger.trace(source.to_s[0..99])
               end
             end
 

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,6 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/assess/policy/trigger/reflected_xss'
+cs__scoped_require 'contrast/agent/assess/policy/trigger/xpath'
+
 module Contrast
   module Agent
     module Assess
@@ -15,12 +18,10 @@ module Contrast
           JSON_GOOD_VALUE = 'good_value'
           JSON_DISALLOWED_TAGS = 'disallowed_tags'
           JSON_REQUIRED_TAGS = 'required_tags'
-          JSON_NODES = 'nodes'
           JSON_RULE_NAME = 'name'
           JSON_CUSTOM_PATCH = 'custom_patch'
 
-          attr_reader :rule_id
-          attr_accessor :required_tags, :disallowed_tags, :good_value, :bad_value
+          attr_reader :rule_id, :required_tags, :disallowed_tags, :good_value, :bad_value
 
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)
@@ -45,8 +46,8 @@ module Contrast
             TRIGGER
           end
 
-          def apply_custom_trigger context, trigger_node, source, object, ret, invoked, *args
-            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, invoked, *args)
+          def apply_custom_trigger context, trigger_node, source, object, ret, *args
+            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, *args)
           end
 
           def custom_trigger_class
@@ -66,7 +67,7 @@ module Contrast
           end
 
           def rule_disabled?
-            Contrast::Agent::FeatureState.instance.assess_disabled_rules.include?(rule_id)
+            ASSESS.rule_disabled?(rule_id)
           end
 
           # Indicate if this is a dataflow based trigger, meaning it has a proper
@@ -161,7 +162,6 @@ module Contrast
             @disallowed_tags << VALIDATOR_START + loud_name
           end
 
-          ENCODED_MARKER = '_ENCODED'
           def validate_rule_tags tags
             return unless tags
 

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -32,43 +32,14 @@ module Contrast
 
               # It is dangerous for the user to control a section of the URL
               # between the start of the protocol and the beginning of the
-              # querystring. If there is no querystring, then the entire URL is
+              # querystring. If there is no path, then the entire URL is
               # dangerous for the User to control.
               start = match.begin(:protocol)
-              finish = match.begin(:query_string)
+              finish = match.begin(:path)
               finish ||= url.length
 
               args[0].cs__properties.any_tags_between?(start, finish)
             end
-
-            # Some SSRF triggers take multiple parameters to build the URL.
-            # For the net_http_# sources, if the first parameter is a String,
-            # the URL is built by appending the first and second parameters.
-            def self.composite? patcher, args
-              id = patcher.id.to_s
-              return false unless id.start_with?(PATH_ONLY_PATCH_MARKER)
-
-              args[0].is_a?(String)
-            end
-
-            def self.build_single_source args
-              return nil unless args[0].cs__respond_to?(:cs__properties)
-
-              args[0].to_s
-            end
-
-            def self.build_composite_source args
-              if args.length > 1
-                return nil unless args[0].cs__respond_to?(:cs__properties) ||
-                    args[1].cs__respond_to?(:cs__properties)
-
-                args[0] + args[1]
-              else
-                return nil unless args[0].cs__respond_to?(:cs__properties)
-
-                args[0].to_s
-              end
-            end
           end
         end
       end

data/lib/contrast/agent/assess/properties.rb

@@ -5,7 +5,8 @@ cs__scoped_require 'set'
 cs__scoped_require 'base64'
 cs__scoped_require 'contrast/utils/prevent_serialization'
 cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/agent/assess/events/event_factory'
+cs__scoped_require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent
@@ -285,8 +286,8 @@ module Contrast
           self
         end
 
-        def build_event policy_node, tagged, object, ret, args, invoked = 0, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args, invoked, source_type, source_name)
+        def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+          event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
           add_event(event)
           report_sources(tagged, event)
         end
@@ -295,6 +296,7 @@ module Contrast
 
         def report_sources tagged, event
           return unless tagged && !tagged.to_s.empty?
+          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
           return unless event&.source_type
 
           current_request = Contrast::Agent::REQUEST_TRACKER.current

data/lib/contrast/agent/assess/rule/base.rb

@@ -13,7 +13,7 @@ module Contrast
         # The base class for each of our Assess Rules
         class Base
           include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :settings
+          access_component :agent, :analysis, :logging, :settings
 
           def initialize
             SETTINGS.assess_rules[name] = self
@@ -46,25 +46,6 @@ module Contrast
               ex.assess_rule?(name)
             end
           end
-
-          def send_report finding
-            finding.rule_id = name
-            finding.hash_code = generate_hash(finding)
-            finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-            finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
-            finding.tags = ASSESS.tags.to_s
-
-            current_context = Contrast::Agent::REQUEST_TRACKER.current
-            current_context.activity.findings << finding
-          end
-
-          def generate_hash finding
-            Contrast::Utils::HashDigest.generate_trigger_hash(finding)
-          end
-
-          def trace_tags
-            @_trace_tags ||= ASSESS.tags.to_s
-          end
         end
       end
     end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 
 module Contrast
   module Agent
@@ -19,7 +19,7 @@ module Contrast
           # 4) redacted_marker : the value to plug in for the obfuscated value
           module HardcodedValueRule
             include Contrast::Components::Interface
-            access_component :contrast_service, :logging, :analysis
+            access_component :analysis, :app_context, :logging, :settings
 
             def disabled?
               !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
@@ -88,12 +88,14 @@ module Contrast
             # The constant name
             SOURCE_KEY = 'source'
 
+            private
+
             def report_finding clazz, constant_string
               class_name = clazz.cs__name
 
               finding = Contrast::Api::Dtm::Finding.new
               finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+              finding.session_id = SETTINGS.session_id
 
               finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
 
@@ -106,12 +108,27 @@ module Contrast
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
 
               activity = Contrast::Api::Dtm::Activity.new
-              activity.finding_tags = Contrast::Utils::StringUtils.protobuf_safe_string(ASSESS.tags)
               activity.findings << finding
 
-              CONTRAST_SERVICE.queue_message activity
+              # If assess is enabled, we can just send the activity
+              if APP_CONTEXT.ready?
+                build_tags(activity)
+                Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
+                # Otherwise, if the Agent isn't ready, we have to queue the messages
+                # until we know the starting state.
+              else
+                Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
+              end
             rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for Hardcoded Rule')
+              logger.error('Unable to build a finding for Hardcoded Rule', e)
+            end
+
+            # This seems silly to pull out, but we can ONLY call this in the case
+            # where we have a configuration. Doing otherwise results in a bad error
+            # case where we try to do other things, like logging, which behave
+            # strangely without a config
+            def build_tags activity
+              activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
             end
           end
         end