contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,7 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/scope'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent
@@ -12,20 +13,15 @@ module Contrast
         #
         # @abstract
         class PolicyNode
-          include Contrast::Components::Interface
-          access_component :scope
-
-          attr_accessor :class_name, :instance_method, :method_name, :method_scope, :method_visibility
-          attr_reader :properties
-
-          def node_class
-            raise NotImplementedError, 'specify the type of the feature for which this node patches'
-          end
-
-          def feature
-            raise NotImplementedError, 'specify the name of the feature for which this node patches'
-          end
-
+          include Contrast::Components::Scope::InstanceMethods
+          JSON_METHOD_VISIBILITY = 'method_visibility'
+          JSON_PROPERTIES = 'properties'
+          JSON_METHOD_NAME = 'method_name'
+          JSON_METHOD_SCOPE = 'scope'
+          # The keys used to read from policy.json to create the individual
+          # policy nodes. These are common across node types
+          JSON_CLASS_NAME = 'class_name'
+          JSON_INSTANCE_METHOD = 'instance_method'
           def initialize policy_hash = {}
             @class_name = policy_hash[JSON_CLASS_NAME]
             @instance_method = policy_hash[JSON_INSTANCE_METHOD]
@@ -36,6 +32,33 @@ module Contrast
             symbolize
           end
 
+          # Name of the class in which the method is being invoked.
+          attr_accessor :class_name
+          # Check for instance method.
+          #
+          # @return true | false
+          attr_accessor :instance_method
+          # The symbol representation of the invoked method.
+          attr_accessor :method_name
+          # Visibility of the invoked method [Private, Public, Protected]
+          attr_accessor :method_visibility
+          # Properties parsed from our JSON policy.
+          attr_reader :properties
+          # Scope of the method parsed from our JSON policy.
+          attr_reader :method_scope
+
+          # @raise [NoMethodError] This is being raised if any of the implementing subclasses does not have
+          #     that method implemented, but is being called on.
+          def node_class
+            raise(NoMethodError, 'specify the type of the feature for which this node patches')
+          end
+
+          # @raise [NoMethodError] This is being raised if any of the implementing subclasses does not have
+          #     that method implemented, but is being called on.
+          def feature
+            raise(NoMethodError, 'specify the name of the feature for which this node patches')
+          end
+
           def id
             @_id ||= "#{ feature }:#{ node_class }:#{ class_name }#{ instance_method? ? '#' : '.' }#{ method_name }"
           end
@@ -43,11 +66,23 @@ module Contrast
           # Don't let nodes be created that will be missing things we need
           # later on. Really, if they don't have these things, they couldn't have
           # done their jobs anyway.
+          #
+          # @raise [ArgumentError] Validates if the created nodes have everything that we'll need now or later on.
           def validate
-            raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.") unless class_name
-            raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.") unless method_name
-            raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.") unless method_name.is_a?(Symbol)
-            raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.") unless method_visibility.is_a?(Symbol)
+            unless class_name
+              raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.")
+            end
+            unless method_name
+              raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.")
+            end
+            unless method_name.is_a?(Symbol)
+              raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.")
+            end
+
+            unless method_visibility.is_a?(Symbol)
+              raise(ArgumentError,
+                    "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.")
+            end
             unless method_scope.nil? || Contrast::Agent::Scope.valid_scope?(method_scope)
               raise(ArgumentError, "#{ node_class } #{ id } requires an undefined scope. Unable to create.")
             end
@@ -60,14 +95,6 @@ module Contrast
             instance_method
           end
 
-          def private?
-            @method_visibility == :private
-          end
-
-          def public?
-            @method_visibility == :public
-          end
-
           private
 
           # Convert strings to symbols here, once, to avoid doing so on every
@@ -77,15 +104,6 @@ module Contrast
             @method_visibility = @method_visibility.to_sym if @method_visibility
             @method_scope = @method_scope.to_sym if @method_scope
           end
-
-          # The keys used to read from policy.json to create the individual
-          # policy nodes. These are common across node types
-          JSON_CLASS_NAME = 'class_name'
-          JSON_INSTANCE_METHOD = 'instance_method'
-          JSON_METHOD_NAME = 'method_name'
-          JSON_METHOD_SCOPE = 'scope'
-          JSON_METHOD_VISIBILITY = 'method_visibility'
-          JSON_PROPERTIES = 'properties'
         end
       end
     end

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+require 'contrast/extension/module'
+require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
   module Agent
@@ -15,17 +15,16 @@ module Contrast
         # input attempted to or did do damage).
         class TriggerNode < PolicyNode
           JSON_NAME = 'name'
-          JSON_NODES = 'nodes'
           JSON_APPLICATOR = 'applicator'
           JSON_APPLICATOR_METHOD = 'applicator_method'
           JSON_REQUIRED_PROPS = 'required_properties'
           JSON_OPTIONAL_PROPS = 'optional_properties'
-          JSON_SCOPE = 'scope'
           JSON_ON_EXCEPTION = 'on_exception'
 
-          attr_reader :rule_id
-          attr_accessor :applicator_method, :applicator, :on_exception, :required_properties, :optional_properties
+          attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties,
+                      :rule_id
 
+          NODE = 'Trigger'
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)
             @rule_id = rule_hash[JSON_NAME]
@@ -38,34 +37,51 @@ module Contrast
             @applicator_method = (trigger_hash[JSON_APPLICATOR_METHOD] || rule_hash[JSON_APPLICATOR_METHOD]).to_sym
           end
 
-          NODE = 'Trigger'
           def node_class
             NODE
           end
 
+          # @raise [ArgumentError] Validates if the created nodes have everything that we'll need now or later on.
           def validate
             super
-            unless applicator.public_methods(false).any? { |method| method == applicator_method }
+            unless applicator.public_methods(false).any?(applicator_method)
               raise(ArgumentError,
-                    "#{ id } did not have a proper applicator method: #{ applicator } does not respond to #{ applicator_method }. Unable to create.")
+                    "#{ id } did not have a proper applicator method: " \
+                    "#{ applicator } does not respond to #{ applicator_method }. Unable to create.")
             end
+            validate_properties
+            validate_rule
+          end
+
+          # @raise [ArgumentError] Validates if the created nodes have everything that we'll need now or later on.
+          def validate_properties
             if (required_properties & optional_properties).any?
-              raise(ArgumentError, "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
+              raise(ArgumentError,
+                    "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
             end
             if (properties.keys - (required_properties | optional_properties)).any?
               raise(ArgumentError, "#{ id } had an unexpected property. Unable to create.")
             end
-            raise(ArgumentError, "#{ id } did not have a required property. Unable to create.") if (required_properties - properties.keys).any?
 
-            validate_rule
+            return unless (required_properties - properties.keys).any?
+
+            raise(ArgumentError, "#{ id } did not have a required property. Unable to create.")
           end
 
+          # @raise [ArgumentError] Validates if the created nodes have everything that we'll need now or later on.
           def validate_rule
             raise(ArgumentError, 'Unknown rule did not have a proper name. Unable to create.') unless rule_id
             raise(ArgumentError, "#{ id } did not have a proper applicator. Unable to create.") unless applicator
-            raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.") unless applicator_method
-            raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.") unless required_properties
-            raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.") unless optional_properties
+
+            unless applicator_method
+              raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.")
+            end
+            unless required_properties
+              raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.")
+            end
+            return if optional_properties
+
+            raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.")
           end
 
           private

data/lib/contrast/agent/protect/exploitable_collection.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Protect
+      # This class will store all exploits or definite attack but
+      # require us to wait for response
+      class ExploitableCollection
+        include Contrast::Components::Logger::InstanceMethods
+
+        def initialize
+          @_collection = []
+        end
+
+        def collection
+          @_collection ||= []
+        end
+
+        # Push the Result we need to store until response is available
+        #
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def push attack_result
+          @_collection << attack_result
+        end
+
+        # Attach attack results to the context
+        #
+        # @param context [Contrast::Agent::RequestContext]
+        def report_recorded_exploits context
+          context.activity.results.concat(@_collection)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/input_analyzer/input_analyzer.rb

@@ -0,0 +1,165 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/agent/reporting/input_analysis/input_analysis'
+require 'contrast/agent/protect/rule/bot_blocker/bot_blocker'
+require 'contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification'
+require 'contrast/agent/protect/rule/cmdi/cmdi_input_classification'
+require 'contrast/agent/protect/rule/no_sqli/no_sqli'
+require 'contrast/agent/protect/rule/no_sqli/no_sqli_input_classification'
+require 'contrast/agent/protect/rule/sqli/sqli_input_classification'
+require 'contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification'
+require 'contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload'
+require 'contrast/agent/protect/rule/path_traversal/path_traversal'
+require 'contrast/agent/protect/rule/path_traversal/path_traversal_input_classification'
+require 'contrast/agent/protect/rule/xss/reflected_xss_input_classification'
+require 'contrast/agent/protect/rule/xss/xss'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'json'
+
+module Contrast
+  module Agent
+    module Protect
+      # InputAnalyzer will extract input form current request context and will analyze it.
+      # This will be used in for the SQLI and CMDI worth_watching_v2 implementations.
+      module InputAnalyzer
+        DISPOSITION_NAME = 'name'
+        DISPOSITION_FILENAME = 'filename'
+        PREFILTER_RULES = %w[bot-blocker unsafe-file-upload reflected-xss].cs__freeze
+        INFILTER_RULES = %w[
+          sql-injection cmd-injection reflected-xss bot-blocker unsafe-file-upload path-traversal
+          nosql-injection
+        ].cs__freeze
+        POSTFILTER_RULES = %w[sql-injection cmd-injection reflected-xss path-traversal nosql-injection].cs__freeze
+        AGENTLIB_TIMEOUT = 5.cs__freeze
+
+        class << self
+          include Contrast::Agent::Reporting::InputType
+          include Contrast::Agent::Reporting::ScoreLevel
+          include Contrast::Utils::ObjectShare
+          include Contrast::Components::Logger::InstanceMethods
+
+          # This method with analyze the user input from the context of the
+          # current request and return new ia with extracted input types.
+          #
+          # @param request [Contrast::Agent::Request] current request context.
+          # @return input_analysis [Contrast::Agent::Reporting::InputAnalysis, nil]
+          def analyse request
+            return unless Contrast::PROTECT.enabled?
+            return if request.nil?
+
+            inputs = extract_input(request)
+            return unless inputs
+
+            input_analysis = Contrast::Agent::Reporting::InputAnalysis.new
+            input_analysis.request = request
+            # Save those for trigger time
+            input_analysis.inputs = extract_input(request)
+            input_analysis
+          end
+
+          # Extract the inputs from the request context and label them with Protect
+          # input type tags. Each tag will contain one or more user inputs.
+          #
+          # This methods is to be expanded and modified as needed by other Protect rules
+          # and sub-rules for their requirements.
+          #
+          # @param request [Contrast::Agent::Request] current request context.
+          # @return inputs [Hash<Contrast::Agent::Protect::InputType => user_inputs>]
+          def extract_input request
+            inputs = {}
+            inputs[BODY] = request.body
+            inputs[COOKIE_NAME] = request.cookies.keys
+            inputs[COOKIE_VALUE] = request.cookies.values
+            inputs[HEADER] = request.headers
+            inputs[PARAMETER_NAME] = request.parameters.keys
+            inputs[PARAMETER_VALUE] = request.parameters.values
+            inputs[QUERYSTRING] = request.query_string
+            inputs[METHOD] = request.request_method
+            extract_multipart(inputs, request)
+            inputs.compact!
+            inputs
+          end
+
+          # classify input by rule
+          #
+          # @param rule_id [String] name of the rule
+          # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis] from
+          # analyze method.
+          def input_classification_for rule_id, input_analysis
+            return unless input_analysis&.inputs
+            return unless (protect_rule = Contrast::PROTECT.rule(rule_id)) && protect_rule.enabled?
+
+            input_analysis.inputs.each do |input_type, value|
+              next if value.nil? || value.empty?
+
+              protect_rule.classification.classify(rule_id, input_type, value, input_analysis)
+            end
+
+            input_analysis
+          rescue StandardError => e
+            logger.error('[INPUT_ANALYZER] Error', error: e)
+          end
+
+          # classify input by array of rules. There is a timeout for the AgentLib analysis if not set it
+          # will use the default 5s.
+          #
+          # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis] Here we will keep all the results
+          #                                                       for each protect rule.
+          # @param prefilter [Boolean] flag to set input analysis for prefilter rules only
+          # @param postfilter [Boolean] flag to set input analysis for postfilter rules.
+          # @param infilter [Boolean]
+          # @param interval [Integer] The timeout determined for the AgentLib analysis to be performed
+          # @return input_analysis [Contrast::Agent::Reporting::InputAnalysis, nil]
+          # @raise [Timeout::Error] If timeout is met.
+          def input_classification(input_analysis,
+                                   prefilter: false,
+                                   postfilter: false,
+                                   infilter: false,
+                                   interval: AGENTLIB_TIMEOUT)
+            return unless input_analysis
+
+            rules = if prefilter
+                      PREFILTER_RULES
+                    elsif postfilter
+                      POSTFILTER_RULES
+                    else
+                      INFILTER_RULES
+                    end
+
+            rules.each do |rule_id|
+              # Check to see if rules is already triggered only for infilter:
+              next if input_analysis.triggered_rules.include?(rule_id) && infilter
+
+              Timeout.timeout(interval) do
+                input_classification_for(rule_id, input_analysis)
+              end
+            end
+            input_analysis
+          rescue Timeout::Error => e
+            logger.warn('AgentLib timed out when processing InputAnalysisResult', e, ia_result)
+            nil
+          end
+
+          private
+
+          # Extract the filename and name of the  Content Disposition Header.
+          #
+          # @param inputs [Hash<Contrast::Agent::Protect::InputType => user_inputs>]
+          # @param request [Contrast::Agent::Request] current request context.
+          def extract_multipart inputs, request
+            return unless (parsed_data = Rack::Multipart.parse_multipart(request.rack_request.env))
+
+            filename = parsed_data[DISPOSITION_FILENAME]
+            inputs[MULTIPART_FIELD_NAME] = filename[DISPOSITION_FILENAME.to_sym] if filename
+            name = filename[DISPOSITION_NAME.to_sym]
+            inputs[MULTIPART_NAME] = name if name
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/input_analyzer/worth_watching_analyzer.rb

@@ -0,0 +1,122 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/thread/worker_thread'
+require 'contrast/agent/reporting/input_analysis/input_analysis_result'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/agent/reporting/reporting_events/application_activity'
+require 'contrast/utils/input_classification_base'
+
+module Contrast
+  module Agent
+    module Protect
+      # WorthWatchingInputAnalyzer Perform analysis of input tracing v2 worthwatching results in a
+      # separate thread, should only be run at the end of the request.
+      # Currently only includes: cmd_injection & sqli_injection rules
+      class WorthWatchingInputAnalyzer < WorkerThread
+        include Timeout
+        include Contrast::Agent::Protect::Rule::InputClassificationBase
+
+        QUEUE_SIZE = 1000.cs__freeze
+        AGENTLIB_TIMEOUT = 5.cs__freeze
+        # max size of inputs to evaluate
+        INPUT_BYTESIZE_THRESHOLD = 100_000.cs__freeze
+        REPORT_INTERVAL_SECOND = 30.cs__freeze
+
+        # Thread that will process all the InputAnalysisResults that have a score level of WORTHWATCHING and
+        # sends results to TeamServer
+        def start_thread!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            logger.info('[WorthWatchingAnalyzer] Starting thread.')
+            loop do
+              sleep(REPORT_INTERVAL_SECOND)
+              next if queue.empty?
+
+              report = false
+              # build attack_results for all infilter active protect rules.
+              stored_ia = queue.pop
+              results = build_results(stored_ia)
+              activity = Contrast::Agent::Reporting::ApplicationActivity.new(ia_request: stored_ia.request)
+              results.each do |result|
+                next unless (attack_result = eval_input(result))
+
+                activity.attach_defend(attack_result)
+                report = true
+              end
+              Contrast::Agent::Reporting::Masker.mask(activity)
+              Contrast::Agent.reporter.send_event(activity) if report
+            rescue StandardError => e
+              logger.error('[WorthWatchingAnalyzer] thread could not process result because of:', e)
+            end
+          end
+        end
+
+        # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis]
+        def add_to_queue input_analysis
+          return unless input_analysis
+
+          if queue.size >= QUEUE_SIZE
+            logger.debug('[WorthWatchingAnalyzer] queue at max size, skip input_result')
+            return
+          end
+          # There will be no results here because of the delay of the protect rule analysis,
+          # we need to save the ia which contains the request and saved extracted user inputs to
+          # be evaluated on the thread rather than building results here. This way we allow the
+          # request to continue and will build the attack results later.
+          queue << input_analysis.dup
+        end
+
+        private
+
+        # This method will build the attack results from the saved ia.
+        #
+        # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis]
+        # @return attack_results [array<Contrast::Agent::Reporting::InputAnalysisResult>] all the results
+        # from the input analysis.
+        def build_results input_analysis
+          # Construct the input analysis for the all the infilter rules that were not triggered.
+          # There is a set timeout for each rule to be analyzed in. The infilter flag will make
+          # sure that if a rule is already triggered during the infilter phase it will not be analyzed
+          # now, making sure we don't report same rule twice.
+          Contrast::Agent::Protect::InputAnalyzer.input_classification(input_analysis, infilter: true)
+          results = input_analysis.results.reject do |val|
+            val.score_level == Contrast::Agent::Reporting::InputAnalysisResult::SCORE_LEVEL::IGNORE
+          end
+          return results if results
+
+          []
+        end
+
+        # @param ia_result Contrast::Agent::Reporting::InputAnalysisResult the WorthWatching InputAnalysisResult
+        # @return [Contrast::Agent::Reporting::AttackResult, nil] InputAnalysisResult updated Result or nil
+        def eval_input ia_result
+          return build_attack_result(ia_result) unless ia_result.value.to_s.bytesize >= INPUT_BYTESIZE_THRESHOLD
+
+          logger.debug("[WorthWatchingAnalyzer] Skipping analysis: Input size is larger than
+                      #{ INPUT_BYTESIZE_THRESHOLD / 1024 }KB")
+          nil
+        end
+
+        # @param ia_result Contrast::Agent::Reporting::InputAnalysisResult the updated InputAnalysisResult
+        # with a score of :DEFINITEATTACK
+        # @return [Contrast::Agent::Reporting::AttackResult] the attack result from
+        #   this input
+        def build_attack_result ia_result
+          Contrast::PROTECT.rule(ia_result.rule_id).build_attack_without_match(nil, ia_result, nil)
+        end
+
+        def queue
+          @_queue ||= Queue.new
+        end
+
+        def delete_queue!
+          @_queue&.clear
+          @_queue&.close
+          @_queue = nil
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/cmdi/cmd_injection'
+require 'contrast/agent/protect/policy/applies_deserialization_rule'
+require 'contrast/agent/protect/policy/rule_applicator'
+
+module Contrast
+  module Agent
+    module Protect
+      module Policy
+        # This Module is how we apply the Command Injection rule. It is called
+        # from our patches of the targeted methods in which command execution
+        # occurs. It is responsible for deciding if the infilter methods of the
+        # rule should be invoked.
+        # In addition, b/c of the nature of Deserialization's sand boxing
+        # function, this Module's apply methods call through to the
+        # {#apply_deserialization_command_check} method of the
+        # Deserialization applicator.
+        module AppliesCommandInjectionRule
+          extend Contrast::Agent::Protect::Policy::RuleApplicator
+
+          CS__SEMICOLON = '; '
+
+          class << self
+            def invoke method, _exception, _properties, object, args
+              return unless valid_command?(args)
+
+              command = build_command(args)
+              Contrast::Agent::Protect::Policy::AppliesDeserializationRule.apply_deserialization_command_check(command)
+              return if skip_analysis?
+
+              clazz = object.is_a?(Module) ? object : object.cs__class
+              class_name = clazz.cs__name
+              # Get the ia for current rule:
+              apply_classification(rule_name, Contrast::Agent::REQUEST_TRACKER.current)
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
+              # invoke cmdi sub-rules.
+              rule.sub_rules.each do |sub_rule|
+                sub_rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
+              end
+            end
+
+            protected
+
+            def rule_name
+              Contrast::Agent::Protect::Rule::CmdInjection::NAME
+            end
+
+            private
+
+            def valid_command? command
+              command && (command.is_a?(String) || command.is_a?(Array))
+            end
+
+            def build_command command
+              return command if command.is_a?(String)
+
+              command = command.drop(1) if command.length > 1
+              command.join(CS__SEMICOLON)
+            end
+          end
+        end
+      end
+    end
+  end
+end