contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -1,12 +1,14 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # The base class used to determine if a user input crosses a token boundary or
 # state, indicating a successful attack using SQL or NoSQL Injection.
 #
 # @deprecated RUBY-356: this class and those that extend it are being phased out
-#   in favor of the more performant code in the Service.
+#   in favor of the more performant code in the Agent Library.
 class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/ClassAndModuleChildren
+  OPERATOR_PATTERN = %r{[+=*^/%><!-]}.cs__freeze
+
   # Potential states
   # :STATE_INSIDE_TOKEN
   # :STATE_INSIDE_NUMBER
@@ -18,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
   # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
   # :STATE_SKIP_NEXT_CHARACTER
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the index of the input in the query
+  # @param input [String] the input value provided by the user
+  # @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
   def crosses_boundary query, index, input
     last_boundary = 0
-    token_boundaries(query).each do |boundary|
+    scan_token_boundaries(query).each do |boundary|
       if boundary > index
-        return last_boundary, boundary if boundary < index + input.length
+        # We should report the previous and overrun boundary if the input crosses one.
+        return last_boundary, boundary if boundary < (index + input.length)
 
         break
       end
@@ -31,11 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     nil
   end
 
-  def token_boundaries query
-    @_token_boundaries ||= scan_token_boundaries(query)
-  end
+  private
 
-  CANARY = "select * from tbl where bar='bar';#' and pwd='sec3r3t'; # CANARY"
+  # @param query [String] the query being executed
+  # @return [Array<Integer>] the boundaries of the query
   def scan_token_boundaries query
     boundaries = []
     return boundaries unless query && !query.empty?
@@ -72,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     boundaries
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param current_state [Symbol] the state of the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_state boundaries, current_state, char, index, query
     case current_state
     when :STATE_EXPECTING_TOKEN
@@ -87,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_expecting_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -111,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_inside_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -124,10 +143,7 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     elsif start_block_comment?(char, index, query)
       boundaries << index
       :STATE_INSIDE_BLOCK_COMMENT
-    elsif operator?(char)
-      boundaries << index
-      :STATE_EXPECTING_TOKEN
-    elsif char.match?(Contrast::Utils::ObjectShare::WHITE_SPACE_REGEXP)
+    elsif operator?(char) || char.match?(Contrast::Utils::ObjectShare::WHITE_SPACE_REGEXP)
       boundaries << index
       :STATE_EXPECTING_TOKEN
     else
@@ -135,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param _query [String] the query being executed
   def process_number boundaries, char, index, _query
     if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
       :STATE_INSIDE_NUMBER
@@ -144,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_double_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -161,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_single_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -178,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def double_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def single_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_escape_sequence_boundary query, index
     idx = index
     while idx < query.length
@@ -201,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_block_comment_boundary query, index
     idx = index
     while idx < query.length
@@ -212,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_new_line_boundary query, index
     idx = index
     while idx < query.length
@@ -224,13 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
-  OPERATOR_PATTERN = %r{[+=*^/%><!-]}.cs__freeze
+  # @param char [String] the character being evaluated
   def operator? char
     char.match?(OPERATOR_PATTERN)
   end
 
   # @note: Any class extending this module should override these methods as needed
   # Are the current and subsequent characters both '-' ?
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_line_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::DASH
     return false unless (query.length - 2) >= index
@@ -240,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the start of a block comment
   # We assume '/*' starts the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::SLASH
     return false unless (query.length - 2) >= index
@@ -249,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the end of a block comment
   # We assume '*/' ends the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def end_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::ASTERISK
     return false unless (query.length - 2) >= index
@@ -268,32 +318,26 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     true
   end
 
-  # Does this language let the user redefine the escape character
-  # We assume no by default
-  def redefines_escape_char?
-    false
-  end
-
   # Is the character provided an escape character?
   # By default, we'll assume
+  #
+  # @param char [String] the character being evaluated
   def escape_char? char
     char == Contrast::Utils::ObjectShare::BACK_SLASH
   end
 
-  # Does this language support string escape sequences?
-  # We assume no by default
-  def support_string_escape_sequence?
-    false
-  end
-
   # Is this the start of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_start? _char
     false
   end
 
   # Is this the end of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_end? _char
     false
   end

data/lib/contrast/agent/protect/rule/{deserialization.rb → deserialization/deserialization.rb}

@@ -1,6 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/reporting/details/untrusted_deserialization_details'
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Protect
@@ -9,26 +13,27 @@ module Contrast
         # Deserialization Protect rule.
         class Deserialization < Contrast::Agent::Protect::Rule::Base
           # The TeamServer recognized name of this rule
+          include Contrast::Components::Logger::InstanceMethods
+          # Used to name this input since input analysis isn't done for this
+          # rule
+          INPUT_NAME = 'Serialized Gadget'
+
           NAME = 'untrusted-deserialization'
 
           # The rule specific reason for raising a security exception.
           BLOCK_MESSAGE = 'Untrusted Deserialization rule triggered. Deserialization blocked.'
 
           # Gadgets that map to ERB modules
-          ERB_GADGETS = %w[
-            object:ERB
-          ].cs__freeze
+          ERB_GADGETS = %W[object:ERB o:\bERB].cs__freeze
 
           # Gadgets that map to ActionDispatch modules
           ACTION_DISPATCH_GADGETS = %w[
             object:ActionDispatch::Routing::RouteSet::NamedRouteCollection
+            o:\bActionDispatch::Routing::RouteSet::NamedRouteCollection
           ].cs__freeze
 
           # Gadgets that map to Arel Modules
-          AREL_GADGETS = %w[
-            string:Arel::Nodes::SqlLiteral
-            object:Arel::Nodes
-          ].cs__freeze
+          AREL_GADGETS = %w[string:Arel::Nodes::SqlLiteral object:Arel::Nodes o:\bArel::Nodes].cs__freeze
 
           # Used to indicate to TeamServer the gadget is an ERB module
           ERB = 'ERB'
@@ -40,7 +45,7 @@ module Contrast
 
           # Return the TeamServer understood id / name of this rule.
           # @return [String] the TeamServer understood id / name of this rule.
-          def name
+          def rule_name
             NAME
           end
 
@@ -53,9 +58,9 @@ module Contrast
           # Per the spec, this rule applies regardless of input. Only the mode
           # of the rule and code exclusions apply at this point.
           # @return [Boolean] should the rule apply to this call.
-          def infilter? _context
+          def infilter? context
             return false unless enabled?
-            return false if protect_excluded_by_code?
+            return false if protect_excluded_by_url?(rule_name, context.request.path)
 
             true
           end
@@ -80,7 +85,9 @@ module Contrast
             result = build_attack_with_match(context, ia_result, nil, serialized_input, **kwargs)
             append_to_activity(context, result)
 
-            raise Contrast::SecurityException.new(self, block_message) if blocked?
+            cef_logging(result, :successful_attack)
+
+            raise(Contrast::SecurityException.new(self, block_message)) if blocked?
           end
 
           # Determine if the issued command was called while we're
@@ -99,7 +106,8 @@ module Contrast
             ia_result = build_evaluation(gadget_command)
             result = build_attack_with_match(context, ia_result, nil, gadget_command, **kwargs)
             append_to_activity(context, result)
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
+            cef_logging(result, :successful_attack, value: gadget_command)
+            raise(Contrast::SecurityException.new(self, BLOCK_MESSAGE)) if blocked?
           end
 
           protected
@@ -107,7 +115,7 @@ module Contrast
           # Build the RaspRuleSample for the detected Deserialization attack.
           # @param context [Contrast::Agent::RequestContext] the request
           #   context in which this attack is occurring.
-          # @param input_analysis_result [Contrast::Api::Settings::InputAnalysisResult]
+          # @param input_analysis_result [Contrast::Agent::Reporting::InputAnalysis]
           #   the result of the analysis done by this rule.
           # @param _candidate_string [nil] unused.
           # @param kwargs [Hash, nil] Hash of inputs used by this rule to flesh
@@ -117,33 +125,30 @@ module Contrast
           #   to render this attack event in TeamServer.
           def build_sample context, input_analysis_result, _candidate_string, **kwargs
             sample = build_base_sample(context, input_analysis_result)
-            sample.untrusted_deserialization = Contrast::Api::Dtm::UntrustedDeserializationDetails.new
+            sample.details = Contrast::Agent::Reporting::Details::UntrustedDeserializationDetails.new
 
-            deserializer = kwargs[:GADGET_TYPE]
-            sample.untrusted_deserialization.deserializer = Contrast::Utils::StringUtils.protobuf_safe_string(deserializer)
+            deserializer = Contrast::Utils::StringUtils.protobuf_safe_string(kwargs[:GADGET_TYPE])
+            sample.details.deserializer = deserializer
 
             command = !!kwargs[:COMMAND_SCOPE]
-            sample.untrusted_deserialization.command = command
+            sample.details.cmd = command
 
             sample
           end
 
           private
 
-          # Used to name this input since input analysis isn't done for this
-          # rule
-          INPUT_NAME = 'Serialized Gadget'
           # We know that this attack happened, so the result is always matched
           # and the level is always critical. Only variable is the Gadget
           # supplied by the attacker.
           # @param gadget_string [String] the input to be deserialized in which
           #   the gadget exists or the command that resulted from deserializing
           #   an input not detected in the initial infilter.
-          # @return [Contrast::Api::Settings::InputAnalysisResult] the result
+          # @return [Contrast::Agent::Reporting::InputAnalysisResult] the result
           #   of the analysis done by this rule.
           def build_evaluation gadget_string
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.rule_id = name
+            ia_result = Contrast::Agent::Reporting::InputAnalysisResult.new
+            ia_result.rule_id = rule_name
             ia_result.input_type = :UNKNOWN
             ia_result.key = INPUT_NAME
             ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(gadget_string)

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,8 +14,7 @@ module Contrast
             # Is the current & next character '//' or are the current and
             # subsequent characters '<--' ?
             def start_line_comment? char, index, query
-              if char == Contrast::Utils::ObjectShare::SLASH &&
-                    query[index + 1] == Contrast::Utils::ObjectShare::SLASH
+              if char == Contrast::Utils::ObjectShare::SLASH && query[index + 1] == Contrast::Utils::ObjectShare::SLASH
                 return true
               end
 

data/lib/contrast/agent/protect/rule/no_sqli/no_sqli.rb

@@ -0,0 +1,105 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/sqli/sql_sample_builder'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/protect/rule/no_sqli/no_sqli_input_classification'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect NoSQL Injection rule.
+        class NoSqli < Contrast::Agent::Protect::Rule::Base
+          # Generate a sample for the No-SQL injection detection rule, allowing for reporting to and rendering
+          # by TeamServer
+          include SqlSampleBuilder::NoSqliSample
+          # Defining build_attack_with_match method
+          include SqlSampleBuilder::AttackBuilder
+          include Contrast::Agent::Reporting::InputType
+
+          NAME = 'nosql-injection'
+          BLOCK_MESSAGE = 'NoSQLi rule triggered. Response blocked.'
+          APPLICABLE_USER_INPUTS = [
+            BODY, COOKIE_NAME, COOKIE_VALUE, HEADER,
+            PARAMETER_NAME, PARAMETER_VALUE, JSON_VALUE,
+            MULTIPART_VALUE, MULTIPART_FIELD_NAME,
+            XML_VALUE, DWR_VALUE
+          ].cs__freeze
+
+          def rule_name
+            NAME
+          end
+
+          def block_message
+            BLOCK_MESSAGE
+          end
+
+          def applicable_user_inputs
+            APPLICABLE_USER_INPUTS
+          end
+
+          # NoSQLI input classification
+          #
+          # @return [module<Contrast::Agent::Protect::Rule::NoSqliInputClassification>]
+          def classification
+            @_classification ||= Contrast::Agent::Protect::Rule::NoSqliInputClassification.cs__freeze
+          end
+
+          # @raise [Contrast::SecurityException] if the attack is blocked
+          #   raised with BLOCK_MESSAGE
+          def infilter context, database, query_string
+            return unless infilter?(context)
+
+            result = find_attacker(context, query_string, database: database)
+            return unless result
+
+            append_to_activity(context, result)
+
+            cef_logging(result, :successful_attack)
+            raise(Contrast::SecurityException.new(self, BLOCK_MESSAGE)) if blocked?
+          end
+
+          def build_attack_with_match context, input_analysis_result, result, candidate_string, **kwargs
+            return result if mode == :NO_ACTION || mode == :PERMIT
+
+            result ||= build_attack_result(context)
+            update_successful_attack_response(context, input_analysis_result, result, candidate_string)
+            append_sample(context, input_analysis_result, result, candidate_string, **kwargs)
+            result
+          end
+
+          protected
+
+          def find_attacker context, potential_attack_string, **kwargs
+            if potential_attack_string
+              # We need the query hash to be a JSON string to match on JSON input attacks.
+              # Before that we need to check if a string is already in json form.
+              begin
+                potential_attack_string = if json?(potential_attack_string)
+                                            potential_attack_string
+                                          else
+                                            JSON.generate(potential_attack_string).to_s
+                                          end
+              rescue JSON::GeneratorError
+                logger.trace('Error in JSON::generate', input: potential_attack_string)
+                nil
+              end
+            end
+            super(context, potential_attack_string, **kwargs)
+          end
+
+          # Check to see if a string is in JSON form.
+          #
+          # @return [Boolean]
+          def json? string
+            return true if JSON.parse(string)
+          rescue StandardError
+            false
+          end
+        end
+      end
+    end
+  end
+end