contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -1,117 +1,129 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/components/logger'
+require 'contrast/extension/module'
+require 'contrast/agent/reporting/report'
 
 module Contrast
   module Agent
     module Assess
       module Rule
         module Provider
-          # Hardcoded rules detect if any secret value has been written directly into the
-          # sourcecode of the application. To use this base class, a provider must
-          # implement four methods
+          # Hardcoded rules detect if any secret value has been written directly into the sourcecode of the
+          # application. To use this base class, a provider must implement three methods:
           # 1) name_passes? : does the constant name match a given value set
-          # 2) value_type_passes? : does the type of the value of the constant match the
-          #    type given
-          # 3) value_passes? : does the value of the constant match a given value set
-          # 4) redacted_marker : the value to plug in for the obfuscated value
+          # 2) value_node_passes? : does the value of the constant match a
+          #    given value set
+          # 3) redacted_marker : the value to plug in for the obfuscated value
           module HardcodedValueRule
-            include Contrast::Components::Interface
-            access_component :contrast_service, :logging, :analysis
+            include Contrast::Components::Logger::InstanceMethods
 
+            # @return [Boolean]
             def disabled?
-              !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
+              !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
             end
 
-            COMMON_CONSTANTS = %i[
-              CONTRAST_ASSESS_POLICY_STATUS
-              VERSION
-            ].cs__freeze
-            def analyze clazz
+            # Parse the file pertaining to the given TracePoint to walk its AST to determine if a Constant is
+            # hardcoded. For our purposes, this hard coding means directly set rather than as an interpolated String or
+            # through a method call.
+            #
+            # Note: This is a top layer check, we make no assertions about what the methods or interpolations do.
+            # Their presence, even if only calling a hardcoded thing, causes this check to not report.
+            #
+            # @param trace_point [TracePoint] the TracePoint event created on the :end of a Module being loaded
+            # @param ast [RubyVM::AbstractSyntaxTree::Node] the abstract syntax tree of the Module defined in the
+            #   TracePoint end event
+            def parse trace_point, ast
               return if disabled?
 
-              # we only want the constants explicitly defined in this class, not
-              # those of its ancestor(s)
-              constants = clazz.cs__constants(false)
-
-              # if there are no constants, let's just leave
-              return unless constants&.any?
-
-              constants.each do |constant|
-                next if COMMON_CONSTANTS.include?(constant)
+              parse_ast(trace_point.self, ast)
+            rescue StandardError => e
+              logger.error('Unable to parse AST for hardcoded keys', e, module: trace_point.self)
+            end
 
-                # if this class autoloads its constant, get the hell away from it
-                # I mean it! Don't even think about it.
-                #
-                # Autoload means this constant (usually [always?] a class or
-                # module) won't be required until something in the application
-                # tries to load it. We CANNOT be that thing. We'll just have to
-                # wait until it's loaded, at which point we'll be handed it
-                # again.
-                next if clazz.cs__autoload?(constant)
+            # The name of the field
+            CONSTANT_NAME_KEY = 'name'
+            # The code line, recreated, with the password obfuscated
+            CODE_SOURCE_KEY = 'codeSource'
+            # The constant name
+            SOURCE_KEY = 'source'
 
-                # constant comes to us as a symbol. that sucks. we need to do
-                # some string methods on it, so stringify it.
-                constant_string = constant.to_s
+            private
 
-                # if this is another class or a module, move on
-                next unless constant_name?(constant_string)
+            # @param mod [Module] the module to which this AST pertains
+            # @param ast [RubyVM::AbstractSyntaxTree::Node, Object] a node within the AST, which may be a leaf, so any
+            #   Object
+            def parse_ast mod, ast
+              return unless ast.cs__is_a?(RubyVM::AbstractSyntaxTree::Node)
+              return unless ast.cs__respond_to?(:children)
 
-                next unless name_passes?(constant_string)
+              children = ast.children
+              return unless children.any?
 
-                value = clazz.cs__const_get(constant, false)
+              ast.children.each do |child|
+                parse_ast(mod, child)
+              end
 
-                # if the constant isn't holding a string, skip it
-                next unless value_type_passes?(value)
+              # https://www.rubydoc.info/gems/ruby-internal/Node/CDECL
+              return unless ast.type == :CDECL
 
-                # if it looks like a placeholder / pointer to a config, skip it
-                next unless value_passes?(value)
+              # The CDECL Node has two children, the first being the Constant name as a symbol, the second as the value
+              # to assign to that constant
+              children = ast.children
+              name = children[0].to_s
+              # If that constant name doesn't pass our checks, move on.
+              return unless name_passes?(name)
 
-                report_finding(clazz, constant_string)
-              end
-            end
+              value = children[1]
+              # The assignment node could be a direct value or a call of some sort. We leave it to each rule to
+              # properly handle these nodes.
+              return unless value_node_passes?(value)
 
-            # Constants can be variable or classes defined in the given
-            # class. We ONLY want the variables, which should be defined in
-            # the MACRO_CASE (upper case & underscore format)
-            CONSTANT_NAME_PATTERN = /^[A-Z_]+$/.cs__freeze
-            def constant_name? constant
-              constant.match?(CONSTANT_NAME_PATTERN)
+              build_and_report(mod, name)
+            rescue StandardError => e
+              logger.error('Unable to parse AST for Hardcoded Rule analysis.', e)
             end
 
-            # The name of the field
-            CONSTANT_NAME_KEY = 'name'
-            # The code line, recreated, with the password obfuscated
-            CODE_SOURCE_KEY = 'codeSource'
-            # The constant name
-            SOURCE_KEY = 'source'
-
-            def report_finding clazz, constant_string
-              class_name = clazz.cs__name
+            # Constants can be set as frozen directly. We need to account for this change as it means the Node given to
+            # the :CDECL call will be a :CALL, not a constant.
+            #
+            # @param value_node [RubyVM::AbstractSyntaxTree::Node] the node to evaluate
+            # @return [Boolean] is this a freeze call or not
+            def freeze_call? value_node
+              return false unless value_node.type == :CALL
 
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+              children = value_node.children
+              return false unless children
+              return false unless children.length >= 2
 
-              finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
+              children[1] == :freeze
+            end
 
-              finding.properties[SOURCE_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(class_name)
-              finding.properties[CONSTANT_NAME_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(constant_string)
-              finding.properties[CODE_SOURCE_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(constant_string + redacted_marker)
+            # @param mod [Module] the module to which this AST pertains
+            # @param name [String] the name of the hardcoded constant
+            def build_and_report mod, name
+              finding = build_finding(mod, name)
+              return unless finding
 
-              hash = Contrast::Utils::HashDigest.generate_class_scanning_hash(finding)
-              finding.hash_code = Contrast::Utils::StringUtils.protobuf_safe_string(hash)
-              finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
+              preflight = Contrast::Agent::Reporting::BuildPreflight.generate(finding)
+              return unless preflight
 
-              activity = Contrast::Api::Dtm::Activity.new
-              activity.finding_tags = Contrast::Utils::StringUtils.protobuf_safe_string(ASSESS.tags)
-              activity.findings << finding
+              Contrast::Agent::Reporting::ReportingStorage[preflight.messages[0].data] = finding
+              Contrast::Agent.reporter&.send_event(preflight)
+            end
 
-              CONTRAST_SERVICE.queue_message activity
-            rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for Hardcoded Rule')
+            # @param clazz [Class] the Class or Module containing the constant
+            # @param constant_string [String]
+            # @return [Contrast::Agent::Reporting::Finding]
+            def build_finding clazz, constant_string
+              finding = Contrast::Agent::Reporting::Finding.new(rule_id)
+              finding.properties[SOURCE_KEY] = clazz.cs__name
+              finding.properties[CONSTANT_NAME_KEY] = constant_string
+              finding.properties[CODE_SOURCE_KEY] = constant_string + redacted_marker
+              finding.hash_code = Contrast::Utils::HashDigest.generate_class_scanning_hash(finding)
+              finding
             end
           end
         end

data/lib/contrast/agent/assess/rule/provider.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -16,6 +16,6 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
-cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'
+require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+require 'contrast/agent/assess/rule/provider/hardcoded_key'
+require 'contrast/agent/assess/rule/provider/hardcoded_password'

data/lib/contrast/agent/assess/rule/response/auto_complete_rule.rb

@@ -0,0 +1,69 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/body_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the body contains a form which
+          # incorrectly sets the autocomplete attribute.
+          class AutoComplete < BaseRule
+            include BodyRule
+            def rule_id
+              'autocomplete-missing'
+            end
+
+            protected
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && body?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              body = response.body
+              forms = html_elements(body, FORM_START_REGEXP, capture_overflow: true)
+              forms.each do |form|
+                # Because TeamServer will reject any subsequent form on the same page due to deduplication, we can
+                # skip out on the first violation.
+                return form if autocomplete?(form[HTML_PROP])
+              end
+              nil
+            end
+
+            def off_values
+              [/"off"/, /'off'/, /off /, /off>/]
+            end
+
+            # Determine if the given form does not have a valid autocomplete tag. Because autocompletion is on by
+            # default, the form must both have the value and set it to being disabled to not autocomplete.
+            #
+            # @param form [String] the form tag
+            # @return [Boolean]
+            def autocomplete? form
+              idx = form =~ /autocomplete=/i
+              return true unless idx
+
+              # Adjust for the length of 'autocomplete='
+              idx += 13
+              off_values.each do |off_value|
+                return false if (form =~ off_value) == idx
+              end
+              true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/base_rule.rb

@@ -0,0 +1,121 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'rack'
+require 'json'
+require 'contrast/agent/reporting/reporting_utilities/build_preflight'
+require 'contrast/utils/hash_digest'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if something was set incorrectly or
+          # insecurely in it.
+          class BaseRule
+            DATA = 'data'.cs__freeze
+            # Analyze a given application response to determine if it violates the rule
+            #
+            # TODO: RUBY-999999 either extract the response's body or memoize it to some degree so that it's not
+            #   generated on every call of this method
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze response
+              return unless analyze_response?(response)
+
+              violation = violated?(response)
+              return unless violation
+
+              finding = build_finding(violation)
+              return unless finding
+
+              preflight = Contrast::Agent::Reporting::BuildPreflight.generate(finding)
+              return unless preflight
+
+              Contrast::Agent::Reporting::ReportingStorage[preflight.messages[0].data] = finding
+              Contrast::Agent.reporter&.send_event(preflight)
+            end
+
+            protected
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              return false unless response
+              return false if disabled?
+              return false unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_response_assess?
+              return false unless valid_response_code?(response.response_code)
+              return false unless valid_content_type?(response.content_type)
+
+              true
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param _response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? _response; end
+
+            def evidence data = Contrast::Utils::ObjectShare::EMPTY_STRING
+              data = Contrast::Utils::ObjectShare::EMPTY_STRING if data.nil?
+              { DATA => data }
+            end
+
+            # Convert the given evidence into a finding. The rule will populate this evidence with each of the
+            #
+            # @param evidence [Hash] the properties required to build this finding.
+            # @return [Contrast::Agent::Reporting::Finding]
+            def build_finding evidence
+              finding = Contrast::Agent::Reporting::Finding.new(rule_id)
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              finding.routes << context.discovered_route if context&.discovered_route
+              build_evidence(evidence, finding)
+              finding.request = Contrast::Agent::Reporting::FindingRequest.convert(context.request) if context&.request
+              hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
+              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
+              finding
+            end
+
+            # This method allows to change the evidence we attach and the way we attach it
+            # Change it accordingly the rule you work on
+            #
+            # @param evidence [Hash] the properties required to build this finding.
+            # @param finding [Contrast::Agent::Reporting::Finding] finding to attach the evidence to
+            def build_evidence evidence, finding
+              evidence.each_pair do |key, value|
+                finding.properties[key] = value
+              end
+            end
+
+            # A rule is disabled if assess is off or it is turned off by TeamServer or by configuration.
+            #
+            # @return [Boolean]
+            def disabled?
+              !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
+            end
+
+            # Rules discern which response codes to which they apply. If the response is of one that the rule should not
+            # examine, it can short circuit early. If the code is unknown, it must be examined.
+            #
+            # @param code [Integer,nil] the response code
+            # @return [Boolean]
+            def valid_response_code? code
+              !code || [301, 302, 307, 404, 410, 500].none?(code)
+            end
+
+            # Rules discern which Content-Type to which they apply. If the response is of one that the rule should not
+            # examine, it can short circuit early. If the type is unknown, it must be examined.
+            #
+            # @param type [String,nil] the value of the Content-Type header
+            # @return [Boolean]
+            def valid_content_type? type
+              !type || [/json/i, /xml/i].none? { |invalid_content| type =~ invalid_content }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/body_rule.rb

@@ -0,0 +1,107 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'rack'
+require 'contrast/utils/hash_digest'
+require 'contrast/utils/string_utils'
+require 'contrast/agent/assess/rule/response/base_rule'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if something was set incorrectly or
+          # insecurely in it.
+          module BodyRule
+            protected
+
+            HTML_PROP = 'html'.cs__freeze
+            START_PROP = 'start'.cs__freeze
+            END_PROP = 'end'.cs__freeze
+            FORM_START_REGEXP = /<form/i.cs__freeze
+            META_TYPE = 'META tag'
+            PRAGMA = 'pragma'
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && body?(response)
+            end
+
+            # Determine if a response has a body or not.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Boolean]
+            def body? response
+              Contrast::Utils::StringUtils.present?(response.body)
+            end
+
+            # Find the elements in this section, if any, so as to determine if they violate this rule.
+            #
+            # @param section [String,nil] html section to find element
+            # @param element_start_str [String] element to find in html section
+            # @return [Array<Hash>] the found elements of this section, as well as their start and end indexes.
+            def html_elements section, element_start_str = '', capture_overflow: false
+              elements = []
+              section_start = 0
+              return [] unless section
+
+              potential_elements(section, element_start_str).flatten.each do |potential_element|
+                next unless potential_element
+                next unless element_openings.any? { |opening| potential_element.start_with?(opening) }
+
+                section_start = section.index(element_start_str, section_start)
+                next unless section_start
+
+                element_stop = potential_element.index('>').to_i
+                next unless element_stop
+
+                section_close = section_start + 6 + element_stop
+                elements << capture(section, section_start, section_close, element_stop, overflow: capture_overflow)
+                section_start = section_close
+              end
+              elements
+            end
+
+            def potential_elements section, element_start
+              section.split(element_start)
+            end
+
+            def element_openings
+              [' ', "\n", "\r", "\t", '>']
+            end
+
+            # Capture the information needed to build the properties of this finding by parsing out from the body
+            #
+            # @param body [String] the entire HTTP Response body
+            # @param body_start [Integer] the start of the range to take from the body
+            # @param body_close [Integer] the end of the range to take from the body
+            # @param tag_stop [Integer] the index of the end of the html tag from its start
+            # @return [Hash]
+            def capture body, body_start, body_close, tag_stop, overflow: false
+              tag = {}
+              # Capture the 50 characters in front of the form, or up to the start if the form starts before 50.
+              if overflow
+                capture_start = body_start < 50 ? 0 : body_start - 50
+                # Start is where the '<form' is in the body
+                # 6 accounts for the characters in the form and the opening char
+                # potential_form.index('>') accounts for finding the rest of the form
+                # 50 accounts for the context to capture beyond
+                capture_close = body_close + 50
+                tag[HTML_PROP] = body[capture_start...capture_close]
+                tag[START_PROP] = body_start < 50 ? body_start : 50
+              else
+                tag[HTML_PROP] = body[body_start...body_close]
+                tag[START_PROP] = body_start
+              end
+              tag[END_PROP] = tag[START_PROP] + 6 + tag_stop
+              tag
+            end
+          end
+        end
+      end
+    end
+  end
+end