contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,169 +1,150 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
-
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/trigger_validation/trigger_validation'
+require 'contrast/agent/excluder/excluder'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/utils/duck_utils'
+require 'contrast/utils/sha256_builder'
+require 'contrast/utils/assess/trigger_method_utils'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/agent/reporting/reporting_events/preflight'
+require 'contrast/agent/reporting/reporting_events/application_activity'
+require 'contrast/agent/reporting/reporting_events/preflight_message'
+require 'contrast/agent/reporting/reporting_events/route_discovery'
+require 'contrast/agent/reporting/reporting_utilities/reporting_storage'
+require 'contrast/agent/reporting/reporting_utilities/build_preflight'
+require 'contrast/utils/assess/event_limit_utils'
 
 module Contrast
   module Agent
     module Assess
       module Policy
-        # A trigger method is one which can perform a dangerous action, as
-        # described by the Contrast::Agent::Assess::Policy::TriggerNode class.
-        # Each such method will call to this module just after invocation in
-        # order to determine if the call was done safely. In those cases where
-        # it was not, a Finding report is issued to the Service
+        # A trigger method is one which can perform a dangerous action, as described by the
+        # Contrast::Agent::Assess::Policy::TriggerNode class. Each such method will call to this module just after
+        # invocation in order to determine if the call was done safely. In those cases where it was not, a Finding
+        # report is issued to TeamServer.
         module TriggerMethod
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Utils::Assess::TriggerMethodUtils
+          extend Contrast::Utils::Assess::EventLimitUtils
 
-          # The level of TeamServer compliance our traces meet
-          CURRENT_FINDING_VERSION = 2
+          # Rules that always exists outside of Request Context
+          # @return [Array<String>]
+          NON_REQUEST_RULES = [
+            'hardcoded-password', # Contrast::Agent::Assess::Rule::Provider::HardcodedPassword.NAME,
+            'hardcoded-key' # Contrast::Agent::Assess::Rule::Provider::HardcodedKey.NAME
+          ].cs__freeze
 
           class << self
-            # This is called from within our woven proc. It will be called as if it
-            # were inline in the Rack application.
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack
+            # application.
             #
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node that applies to the method being called
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node that applies to the method
+            #   being called
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
-
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless current_context&.analyze_request? && ASSESS.enabled?
+              return if event_limit_for_rule?(trigger_node.rule_id)
+
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              # return if there is no context and the flag is set to default => false
+              # we need to have request if the flag is default
+              # else proceed, if the flag is true we don't need to check for context we
+              # go as currently.
+              # When outside of a request, only track when the feature is enabled
+              return unless context ||
+                  Contrast::ASSESS.non_request_tracking? ||
+                  NON_REQUEST_RULES.include?(trigger_node.rule_id)
 
               if trigger_node.sources&.any?
                 trigger_node.sources.each do |marker|
                   source = determine_source(marker, object, ret, args)
-                  apply_trigger(current_context,
-                                trigger_node,
-                                source,
-                                object,
-                                ret,
-                                1,
-                                *args)
+                  apply_trigger(trigger_node, source, object, ret, *args)
                 end
               else
-                apply_trigger(current_context,
-                              trigger_node,
-                              nil,
-                              object,
-                              ret,
-                              1,
-                              *args)
+                apply_trigger(trigger_node, nil, object, ret, *args)
               end
             end
 
-            def apply_eval_trigger context, trigger_node, source, object, ret, invoked, *args
-              apply_trigger(context, trigger_node, source, object, ret, invoked, *args)
+            def apply_eval_trigger trigger_node, source, object, ret, *args
+              apply_trigger(trigger_node, source, object, ret, *args)
             end
 
-            # This converts the source of the finding, and the events leading
-            # up to it into a Finding
+            # This converts the source of the finding, and the events leading up to it into a Finding
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
+            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
+            #   trigger event
             # @param source [Object] the source of the Trigger Event
             # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Contrast::Api::Dtm::Finding, nil] the
-            #   Contrast::Api::Dtm::Finding to send to TeamServer or nil if
-            #   conditions were not met
-            def build_finding context, trigger_node, source, object, ret, invoked, *args
+            # @param ret [Object, nil] the Return of the invoked method, or nil if void method
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Contrast::Agent::Reporting::Finding, nil] the finding to send to TeamServer if found
+            def build_finding trigger_node, source, object, ret, *args
+              content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
+              if content_type.nil? && trigger_node.collectable?
+                Contrast::Agent::FINDINGS.collect_finding(trigger_node, source, object, ret, *args)
+                return
+              end
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
-              request = context.request
-              env = request.env
-              return if defined?(ActionController::Live) &&
-                  env &&
-                  env['action_controller.instance'].cs__class.included_modules.include?(ActionController::Live)
+              request = find_request(source)
+              return unless reportable?(request&.env)
+              return if excluded_by_url_and_rule?(request, trigger_node.rule_id)
 
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-              finding.version = CURRENT_FINDING_VERSION
+              finding = Contrast::Agent::Reporting::Finding.new(trigger_node.rule_id)
+              finding.attach_data(trigger_node, source, object, ret, request, *args)
+              return if excluded_by_input_and_rule?(request, finding, trigger_node.rule_id)
 
-              build_from_source(finding, source)
-              trigger_event = Contrast::Agent::Assess::ContrastEvent.new(trigger_node, source, object, ret, args, invoked + 1).to_dtm_event
-              finding.events << trigger_event
-              build_hash(finding, source)
-              build_tags(context)
-              finding.routes << context.route if context.route
-              context.activity.findings << finding
-              logger.debug(nil, "Trigger #{ trigger_node.id } detected: #{ source.__id__ } triggered #{ trigger_node.rule_id }")
+              finding.hash_code = Contrast::Utils::HashDigest.generate_event_hash(finding, source, request)
+              check_for_stored_xss(finding)
+              finding
             rescue StandardError => e
-              logger.error(e, "Unable to build a finding for #{ trigger_node.id }")
+              logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
+              nil
             end
 
-            private
+            # Given a finding, append it to an activity message and send it to the TeamServer for processing. If an
+            # activity message does not exist, b/c we're invoked outside of a request context, build an activity and
+            # immediately report it with the finding.
+            #
+            # @param finding [Contrast::Agent::Reporting::Finding] the Finding to report.
+            def report_finding finding
+              return unless finding
 
-            def settings
-              Contrast::Agent::FeatureState.instance
-            end
+              preflight = Contrast::Agent::Reporting::BuildPreflight.generate(finding)
+              return unless preflight
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets.
-            #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
-            # @param source [Object] the source of the Trigger Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            def apply_trigger context, trigger_node, source, object, ret, invoked, *args
-              return unless context && trigger_node
-              return if trigger_node.rule_disabled?
-              return if trigger_node.dataflow? && source.nil?
+              preflight_data = preflight.messages[0].data
+              return if Contrast::Agent::REQUEST_TRACKER.current&.reported_findings&.include?(preflight_data)
 
-              invoked += 1
-              if trigger_node.regexp_rule?
-                apply_regexp_rule(context, trigger_node, source, object, ret, invoked, *args)
-              elsif trigger_node.custom_trigger?
-                trigger_node.apply_custom_trigger(context, trigger_node, source, object, ret, invoked, *args)
-              elsif trigger_node.dataflow?
-                apply_dataflow_rule(context, trigger_node, source, object, ret, invoked, *args)
-              else # trigger rule - just calling the method is dangerous
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
+              Contrast::Agent::Reporting::ReportingStorage[preflight.messages[0].data] = finding
+              if Contrast::Agent::REQUEST_TRACKER.current
+                Contrast::Agent::REQUEST_TRACKER.current.reported_findings << preflight_data
               end
-            rescue StandardError => e
-              logger.warn(e, 'Unable to apply trigger.')
+              Contrast::Agent.reporter&.send_event(preflight)
+            end
+
+            private
+
+            def settings
+              Contrast::Agent::FeatureState.instance
             end
 
-            # Given the marker from the trigger_node (the pointer indicating
-            # the entity from which the taint originated), return the entity on
-            # which this trigger needs to operate.
+            # Given the marker from the trigger_node (the pointer indicating the entity from which the taint
+            # originated), return the entity on which this trigger needs to operate.
             #
-            # In an effort to speed up this lookup, we've changed the marker
-            # for parameters to be implicit - if it is not a return or an
-            # object, it must be a parameter, which we can reference either by
-            # index or by name.
+            # In an effort to speed up this lookup, we've changed the marker for parameters to be implicit - if it is
+            # not a return or an object, it must be a parameter, which we can reference by index.
             #
-            # @param marker [String] the source marker that indicates which
-            #   Object
+            # @param marker [String] the source marker that indicates which Object
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Object] the literal object that this Trigger Event
-            #   verifies
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Object] the literal object that this Trigger Event verifies
             def determine_source marker, object, ret, args
               case marker
               when Contrast::Utils::ObjectShare::RETURN_KEY
@@ -186,105 +167,61 @@ module Contrast
               end
             end
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets for our Regexp based rules.
-            #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
-            # @param source [Object] the source of the Trigger Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            def apply_regexp_rule context, trigger_node, source, object, ret, invoked, *args
-              return unless source.is_a?(String)
-              return if trigger_node.good_value && source.match?(trigger_node.good_value)
-              return if trigger_node.bad_value && source !~ trigger_node.bad_value
+            def build_events finding, event
+              return unless event
 
-              invoked += 1
-              build_finding(context, trigger_node, source, object, ret, invoked, *args)
+              event.parent_events&.each do |parent_event|
+                build_events(finding, parent_event)
+              end
+              # events could technically be nil, but we would have failed the rule check before getting here. not
+              # worth the nil check
+              finding.events << event.to_dtm_event
             end
 
-            # This is our method that actually checks the taint on the object
-            # our trigger_node targets for our Dataflow based rules.
+            # Check if the finding should be excluded due to the assess exclusion rules.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode]
-            #   the node to direct applying this trigger event
-            # @param source [Object] the source of the Trigger Event
-            # @param object [Object] the Object on which the method was invoked
-            # @param ret [Object] the Return of the invoked method
-            # @param invoked [Integer] the depth of this invocation from
-            #   application code; often a lie.
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            def apply_dataflow_rule context, trigger_node, source, object, ret, invoked, *args
-              return unless source
-
-              invoked += 1
-              if Contrast::Utils::DuckUtils.quacks_to?(source, :cs__properties)
-                return unless source.cs__tracked?
-                return unless trigger_node.violated?(source)
-
-                build_finding(context, trigger_node, source, object, ret, invoked, *args)
-              elsif Contrast::Utils::DuckUtils.iterable_hash?(source)
-                invoked += 2 # the each & the block
-                source.each_pair do |key, value|
-                  apply_dataflow_rule(context, trigger_node, key, object, ret, invoked, *args)
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
-                end
-              elsif Contrast::Utils::DuckUtils.iterable_enumerable?(source)
-                invoked += 2 # the each & the block
-                source.each do |value|
-                  apply_dataflow_rule(context, trigger_node, value, object, ret, invoked, *args)
-                end
-              else
-                logger.warn(
-                    nil,
-                    "Target is a #{ source.cs__class.name } -- not sure how to inspect: #{ trigger_node.inspect }")
-                logger.debug(nil, source.to_s[0..99])
-              end
+            # @param request [Contrast::Agent::Request] a wrapper around the Rack::Request for the current request
+            # @param rule_id [String]
+            # return [Boolean]
+            def excluded_by_url_and_rule? request, rule_id
+              Contrast::SETTINGS.excluder.assess_excluded_by_url_and_rule?(request, rule_id)
             end
 
-            def build_from_source finding, source
-              return unless source
-              return unless Contrast::Utils::DuckUtils.quacks_to?(
-                  source,
-                  :cs__properties)
-              return unless source.cs__properties
+            def excluded_by_input_and_rule? request, finding, rule_id
+              Contrast::SETTINGS.excluder.assess_excluded_by_input_and_rule?(request, finding, rule_id)
+            end
 
-              # events could technically be nil, but we would have failed
-              # the rule check before getting here. not worth the nil check
-              source.cs__properties.events.each do |event|
-                finding.events << event.to_dtm_event
-              end
+            # Handles the Stored Xss rule. If a vector is stored in the database
+            def check_for_stored_xss finding
+              return unless finding && finding.rule_id == 'reflected-xss'
 
-              # Google::Protobuf::Map doesn't support merge!, so we have to do this
-              # long form
-              source_props = source.cs__properties.properties
-              return unless source_props
+              # Check for database tainted event propagation:
+              if finding.events.select { |event| event.reportable_tags.include?('DATABASE_WRITE') }.
+                    any? && !Contrast::ASSESS.disabled_rules.include?('stored-xss')
 
-              source_props.each_pair do |key, value|
-                key = Contrast::Utils::StringUtils.force_utf8(key)
-                finding.properties[key] = Contrast::Utils::StringUtils.force_utf8(value)
+                # Override 'reflected-xss' => 'stored-xss'
+                finding.instance_variable_set(:@rule_id, 'stored-xss')
+                extract_dynamic_source_info(finding)
+                finding
               end
             end
 
-            def build_hash finding, source
-              hash_code = Contrast::Utils::HashDigest.generate_event_hash(finding, source)
-              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
-              finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-            end
-
-            def build_tags context
-              return unless ASSESS.tags
-
-              context.activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
+            def extract_dynamic_source_info finding
+              return unless finding
+
+              creation_events = finding.events.select { |e| e.action == :CREATION }
+              source_event_policy = creation_events[0].policy_node if creation_events.any?
+              properties = source_event_policy.properties if source_event_policy
+              # Properties example:
+              # => {"dynamic_source_id"=>"Assess:Source:Comment#message",
+              #  "dynamic_source_name"=>"Comment.message",
+              #  "readTable"=>"Comment",
+              #  "readColumn"=>:message,
+              #  "writeDateTimeUtc"=>1675087341948,
+              #  "writeRequestUrl"=>"/comments"}
+              return if Contrast::Utils::DuckUtils.empty_duck?(properties)
+
+              finding.instance_variable_set(:@properties, finding.properties.merge(properties))
             end
           end
         end