contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/preflight_util.rb

@@ -1,13 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility for generating preflight message token
-    class PreflightUtil
-      def self.create_preflight finding
-        "#{ finding.rule_id },#{ finding.hash_code }"
-      end
-    end
-  end
-end

data/lib/contrast/utils/prevent_serialization.rb

@@ -1,52 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # DO NOT REMOVE THIS!
-    #
-    # Marshal is pretty cool. It does a lot of things well. What it doesn't
-    # mess around with though is StringIO. And what we don't want to do is
-    # serialize ourselves out with Marshal#dump.
-    #
-    # Unfortunately, we have to mess around w/ that. To isolate our things from
-    # user dumped Strings (and so that we can marshal findings), we have
-    # decided to make this class not marshalled.
-    module PreventMarshalSerialization
-      def marshal_dump
-        nil
-      end
-
-      def marshal_load *_args
-        nil
-      end
-    end
-
-    # DO NOT REMOVE THIS!
-    #
-    # Psych/YAML is also pretty cool. But it doesn't mess with anonymous
-    # classes. In order to make things we extend serializable, we need to make
-    # sure we play nice.
-    module PreventPsychSerialization
-      def encode_with *_args
-        nil
-      end
-
-      def init_with *_args
-        nil
-      end
-    end
-
-    # DO NOT REMOVE THIS!
-    #
-    # This module is used to prevent deserialization of our classes, not b/c
-    # we're trying to be sneaky, but b/c there is a high probability that the
-    # events we're capturing have non-serializable data in them and b/c we
-    # can't be sure the serialized data will be used in an application running
-    # Contrast.
-    module PreventSerialization
-      include PreventMarshalSerialization
-      include PreventPsychSerialization
-    end
-  end
-end

data/lib/contrast/utils/rack_assess_session_cookie.rb

@@ -1,104 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze non-rails session storage configuration for assess vulnerabilities
-    module RackAssessSessionCookie
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_NAME = 'rails-http-only-disabled'
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_cookie_initialization options
-          return if PROTECT.enabled?
-
-          apply_session_timeout(options)
-          apply_httponly(options)
-          apply_secure_session(options)
-        end
-
-        def vulnerable_setting?(setting_key,
-                                safe_settings_value,
-                                options, safe_default: true,
-                                comparison_type: nil)
-          # In most cases, Rack is pretty nice and the default value is safe
-          return !safe_default unless options&.key?(setting_key)
-
-          value = options[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_secure_session options
-          return unless vulnerable_setting?(
-              :secure,
-              true,
-              options,
-              safe_default: false)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SECURE_RULE_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to secure session', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_session_timeout options
-          return unless vulnerable_setting?(:expire_after,
-                                            SAFE_SESSION_TIMEOUT,
-                                            options,
-                                            safe_default: false,
-                                            comparison_type: :greater_than)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SESSION_TIMEOUT_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly options
-          return unless vulnerable_setting?(:httponly, true, options)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__HTTPONLY_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to httponly', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/rails_assess_configuration.rb

@@ -1,95 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze rails session storage configuration for assess vulnerabilities
-    module RailsAssessConfiguration
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
-
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_session_store *args
-          return if PROTECT.enabled?
-
-          apply_httponly_disabled(*args)
-          apply_secure_cookie_disabled(*args)
-          apply_session_timeout(*args)
-        end
-
-        def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
-          # In most cases, Rails is pretty nice and the default value is safe
-          return !safe_default unless original_args && original_args.length > 1
-
-          # If the user overrode some args, but not ours, fall back on the default
-          rails_session_settings = original_args[1]
-          return !safe_default unless rails_session_settings&.key?(setting_key)
-
-          value = rails_session_settings[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_session_timeout *args
-          return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
-          return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_secure_cookie_disabled *args
-          return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
-          return unless vulnerable_setting?(:secure, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to disable secure cookies', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly_disabled *args
-          return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
-          return unless vulnerable_setting?(:httponly, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to disable httponly in session cookie', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/random_util.rb

@@ -1,22 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'securerandom'
-
-module Contrast
-  module Utils
-    # Utilites for generating random strings
-    class RandomUtil
-      RANDOM_CHARS = (('0'..'9').to_a + ('A'..'Z').to_a).cs__freeze
-      RANDOM_LENGTH = RANDOM_CHARS.length
-
-      def self.secure_random_string len
-        arr = []
-        len.to_i.times do
-          arr << RANDOM_CHARS[SecureRandom.random_number(RANDOM_LENGTH)]
-        end
-        arr.join
-      end
-    end
-  end
-end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -1,74 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'parser/current'
-
-module Contrast
-  module Utils
-    # This utility allows us to parse and rewrite the AST in Ruby 2.4 & 2.5,
-    # allowing us to track String interpolation propagation by replacing those
-    # events with String#+ events instead.
-    class RubyAstRewriter < Parser::TreeRewriter
-      VARIABLES = %i[ivar cvar gvar].cs__freeze
-
-      # Rewrite the given source_string, converting the interpolation action
-      # therein to a concatenation action
-      #
-      # @param source_string [String] the String to rewrite
-      # @return [String] either the rewritten string or the original on error.
-      def rewrite source_string
-        ast = Parser::CurrentRuby.parse(source_string)
-        buffer = Parser::Source::Buffer.new('rewrite')
-        buffer.source = source_string
-        begin
-          super(buffer, ast)
-        rescue StandardError => _e
-          source_string
-        end
-      end
-
-      # This overloads the on_dstr method in Parser::AST::Processor to handle
-      # the replace within the given node.
-      def on_dstr node
-        return if node.children.all? { |child_node| child_node.type == :str }
-
-        new_content = +'('
-        node.children.each_with_index do |child_node, index|
-          # A begin node looks like #{some_code} in ruby, we do a substring
-          # from [2...-1] to get rid of the #{ & trailing }.
-          if child_node.type == :begin
-            code = child_node.
-                location.
-                expression.
-                source_buffer.
-                source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
-            code = code[2...-1]
-            new_content += "((#{ code }).to_s)"
-
-          # For interpolations that use class, instance, or global variables,
-          # those are NOT within a begin block, but instead are a ivar, cvar,
-          # or gvar node, not stripping of interpolation markers required.
-          elsif VARIABLES.include?(child_node.type)
-            variable = child_node.children.first
-            new_content << "((#{ variable }).to_s)"
-
-          # When interpolation includes strings before or after an
-          # interpolation they are simple :str nodes, in order to preserve
-          # escaping we need to do a dump of the string value.
-          elsif child_node.type == :str
-            literal_value = child_node.children.first
-            literal_value = literal_value.dump[1...-1]
-            new_content <<  "\"#{ literal_value }\""
-          end
-          new_content << ' + ' unless index == node.children.length - 1
-        end
-        new_content << ')'
-        if node.location.cs__respond_to?(:heredoc_body)
-          replace(node.location.heredoc_body, new_content)
-        else
-          replace(node.location.expression, new_content)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/service_response_util.rb

@@ -1,110 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility class for processing responses from the Contrast Service. Specifically, this class
-    # processes Server and Application settings and updates the Settings component.
-    module ServiceResponseUtil
-      include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :settings, :analysis
-
-      class << self
-        # TODO: RUBY-119
-        def process_response response
-          fs = Contrast::Agent::FeatureState.instance
-          fs.last_update = response&.sent_ms
-          server_features = process_server_response(response)
-          app_settings = process_application_response(response)
-
-          # ReactionProcessor is a design pattern from TeamServer.
-          # Right now, there's one potential reaction, which is disabling the agent
-          Contrast::Agent::ReactionProcessor.process(response&.application_settings)
-          # Determine new accumulator state
-          if (new_accum = response&.accumulator_settings)
-            SETTINGS.accumulator_settings.replace(new_accum)
-          end
-
-          fs.logger_manager.update(server_features&.log_file, server_features&.log_level)
-          update_features(server_features, app_settings)
-          logger.debug("Agent modes: P-#{ fs.protect_enabled? ? 'ENABLED' : 'DISABLED' }, A-#{ fs.assess_enabled? ? 'ENABLED' : 'DISABLED' }")
-        end
-
-        private
-
-        # Given some protobuf messages, update settings.
-        # This is the bridge between Contrast Service <-> Settings.
-        LOG_SERVER_SETTINGS_UPDATE = 'Agent: Received updated server features'
-        LOG_UPDATE_PROTECT         = 'Updating Protect state'
-        LOG_UPDATE_ASSESS          = 'Updating Assess state'
-        def process_server_response response
-          server_features = response&.server_features
-          return unless server_features
-
-          logger.debug(LOG_SERVER_SETTINGS_UPDATE)
-          # 'defend' is legacy for 'protect' in the dtm.
-          protect = server_features.defend
-          assess = server_features.assess
-
-          protect_enable = !!protect.enabled
-          assess_enable =  !!assess.enabled
-
-          # protect
-          begin
-            logger.debug(LOG_UPDATE_PROTECT)
-            SETTINGS.protect_state[:enabled] = protect_enable
-          end
-
-          # assess
-          begin
-            logger.debug(LOG_UPDATE_ASSESS)
-            SETTINGS.assess_state[:enabled] = assess_enable
-            SETTINGS.assess_state[:sampling_settings] = assess.sampling
-          end
-
-          server_features
-        end
-
-        MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
-        LOG_APP_SETTINGS_UPDATE = 'Agent: Received updated application settings'
-        def process_application_response response
-          app_settings = response&.application_settings
-          return unless app_settings
-
-          logger.debug(LOG_APP_SETTINGS_UPDATE)
-          exclusion_matchers = app_settings.exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
-          protection_rules = app_settings.protection_rules.map { |pr, _hash| [pr.id, pr.mode] }
-          protection_rules.select! { |(_id, mode)| MODE_WHITELIST.include? mode }
-          modes_by_id = protection_rules.to_h
-          SETTINGS.application_state.merge!(
-              modes_by_id: modes_by_id,
-              exclusion_matchers: exclusion_matchers,
-              disabled_assess_rules: app_settings.disabled_assess_rules,
-              session_id: app_settings.session_id)
-
-          app_settings
-        end
-
-        # This is can also go into settings/c.service, but it
-        # requires protobuf decorators to be pretty and decomposed.
-        LOG_INFO_RULE_SETTINGS = 'Current rule settings:'
-        def update_features server_features, app_settings
-          if !!(server_features || app_settings)
-            logger.debug_with_time('Rebuilding rule modes') do
-              SETTINGS.build_protect_rules if PROTECT.enabled?
-              SETTINGS.build_assess_rules  if ASSESS.enabled?
-
-              logger.info(LOG_INFO_RULE_SETTINGS)
-              PROTECT.rules.each { |k, v| logger.info(".. protect: #{ k } (#{ v.mode })") }
-              ASSESS.rules.each { |k, v| logger.info(".. assess:  #{ k } (#{ v.enabled? })") }
-            end
-          end
-
-          # This is for assess
-          # PERF, we could avoid here with dirty-tracking.
-          Contrast::Utils::Assess::SamplingUtil.instance.update
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/service_sender_util.rb

@@ -1,106 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module keeps a background thread, initialized at startup, running. This thread is
-    # responsible for pulling a message off the queue, sending that message to SpeedRacer, and
-    # processing the response returned back from SpeedRacer. When we didn't know our config
-    # values, we may have queued assess messages to send later. This thread is also
-    # responsible for checking to see if we are now ready to send any of these assess messages
-    # to SpeedRacer.
-    module ServiceSenderUtil
-      include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :analysis, :agent
-
-      class << self
-        attr_reader :assess_messages, :ready_messages_queue
-
-        # Push the given DTM into a queue to be sent to the Service.
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
-        #   Contrast::Api::Dtm::Message
-        def push_to_ready_queue event
-          return unless event
-
-          # Since a message may try to be pushed before sending_thread starts up, we need to initialize
-          # the queue on first message sent
-          @ready_messages_queue ||= Queue.new
-          ready_messages_queue.push event
-          logger.debug("Enqueued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
-        end
-
-        def sending_thread
-          # in case we got here before a message attempted to be sent, let's make sure these are initialized
-          @ready_messages_queue ||= Queue.new
-          @assess_messages ||= []
-
-          @_sender_thread ||= Contrast::Agent::Thread.new do
-            loop do
-              check_assess_queue if assess_messages # don't bother checking if assess queue is already cleared
-              # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
-              event = ready_messages_queue.pop
-              begin
-                logger.debug("Dequeued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
-                response = Contrast::Agent::FeatureState.instance.client.send_to_speedracer event
-                Contrast::Utils::ServiceResponseUtil.process_response(response) if response
-              rescue StandardError => e
-                logger.error(e, 'Could not send message to service from service sender thread.')
-              end
-            end
-          end
-          logger.debug(nil, 'Started background sending thread.')
-        end
-        alias_method :start, :sending_thread
-
-        def stop
-          Thread.kill(@_sender_thread) if @_sender_thread&.alive?
-        end
-
-        def add_to_assess_messages msg
-          # This list holds messages containing assess findings. We currently
-          # do not know if the agent is running in assess, so until we do then
-          # we must keep the messages stored here.
-          @assess_messages ||= []
-          assess_messages << msg
-        end
-
-        private
-
-        def check_assess_queue
-          return unless AGENT.ready?
-
-          if ASSESS.enabled?
-            assess_messages.each do |msg|
-              update_queued_finding msg
-              ready_messages_queue.push msg # this message is ready to be sent to SR
-            end
-          end
-          @assess_messages = nil # clear out queue, we no longer need it
-        end
-
-        # When we queued up findings, we didn't have access to a configuration
-        # object. As such, we have to make decisions now for those findings.
-        def update_queued_finding msg
-          # Findings only exist in activity messages
-          return unless msg.is_a?(Contrast::Api::Dtm::Activity)
-
-          # So set their tags
-          msg.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-
-          # and see if they're even enabled
-          check = msg.findings.dup
-          check.each do |finding|
-            msg.findings.delete(finding) if ASSESS.rule_disabled?(finding.rule_id)
-          end
-
-          msg.findings.each do |finding|
-            finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/sinatra_helper.rb

@@ -1,55 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # This module is to help perform sometimes necessary tasks specific to Sinatra
-    module SinatraHelper
-      SINATRA_VIEWS = [
-        ['public/stylesheets', '*.scss', %w[SASS]],
-        ['views', '*.html', %w[HTML5]],
-        ['views', '*.html.erb', %w[HTML5 ERB]],
-        ['views', '*.html.haml', %w[HTML5 HAML]],
-        ['public', '*.html', %w[HTML5]]
-      ].cs__freeze
-
-      def self.app_class
-        @_app_class ||= begin
-          return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-          sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
-          result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-          result_layer
-        end
-      end
-
-      def self.scannable_view_dirs
-        @_scannable_view_dirs ||= begin
-          views = SINATRA_VIEWS.dup
-          views << [view_directory, '*.erb', %w[HTML5 ERB]] if view_directory
-          views << [view_directory, '*.haml', %w[HTML5 HAML]] if view_directory
-          views << [public_directory, '*.html', %w[HTML5]] if public_directory
-          views
-        end
-      end
-
-      def self.settings_instance
-        @_settings_instance ||= begin
-                                  app_class&.settings
-                                end
-      end
-
-      def self.view_directory
-        @_view_directory ||= begin
-          app_class&.settings&.views
-        end
-      end
-
-      def self.public_directory
-        @_public_directory ||= begin
-          app_class&.settings&.public_dir
-        end
-      end
-    end
-  end
-end

data/resources/csrf/inject.js

@@ -1,44 +0,0 @@
-<script>
-  function _contrast_isSameOrigin(action) {
-    var thisDomain = document.domain;
-    var parser = document.createElement('a');
-    parser.href = action;
-    return parser.hostname == thisDomain;
-  }
-
-  function _contrast_addTokenToForms() {
-    for(var i=0;i<document.forms.length;i++) {
-      var form = document.forms[i];
-      var action = form.action;
-      if(!!action || _contrast_isSameOrigin(action)) {
-        if(!form._contrast_tokenized) {
-          var input = document.createElement("input");
-          input.setAttribute("type", "hidden");
-          input.setAttribute("name", "!TOKEN_NAME!");
-          input.setAttribute("value", "!TOKEN_VALUE!");
-          form.appendChild(input);
-          form._contrast_tokenized = true;
-        }
-      }
-    }
-  }
-
-  (function() {_contrast_addTokenToForms();})();
-
-  var _contrast_watchNewForms = (function() {
-    var MutationObserver = window.MutationObserver || window.WebKitMutationObserver, eventListenerSupported = window.addEventListener;
-    return function(obj, callback) {
-      if(MutationObserver) {
-        var obs = new MutationObserver(function(mutations, observer) {
-          if( mutations[0].addedNodes.length )
-            callback();
-        });
-        obs.observe(obj, { childList:true, subtree:true });
-      } else if(eventListenerSupported) {
-        obj.addEventListener('DOMNodeInserted', callback, false);
-      }
-    }
-  })();
-
-  _contrast_watchNewForms(document.body, function() { _contrast_addTokenToForms(); });
-</script>