contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb

@@ -0,0 +1,226 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/no_sqli/no_sqli'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/utils/input_classification_base'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This module will do the Input Classification stage of NoSQLI rule
+        # as a result input would be marked as WORTHWATCHING or IGNORE,
+        # to be analyzed at the sink level.
+        module NoSqliInputClassification
+          class << self
+            include InputClassificationBase
+
+            NOSQL_COMMENT_REGEXP = %r{"\s*(?:<--|//)}.cs__freeze
+            NOSQL_OR_REGEXP = /(?=(\s+\|\|\s+))/.cs__freeze
+            NOSQL_COMMENTS_AFTER_REGEXP = %r{(?:<--|//)}.cs__freeze
+
+            ZERO_OR_MORE_SPACES_REGEXP = /\s*/.cs__freeze
+            QUOTE_REGEXP = /['"’‘]/.cs__freeze
+            NUMBERS_AND_LETTERS_REGEXP = /[[:alnum:]]+/.cs__freeze
+            COMPARISON_REGEXP = /(?:==|>=|<=|>|<|)/.cs__freeze
+            NOSQL_QUOTED_REGEXP = /
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ QUOTE_REGEXP }
+              #{ NUMBERS_AND_LETTERS_REGEXP }
+              #{ QUOTE_REGEXP }
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ COMPARISON_REGEXP }
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ QUOTE_REGEXP }
+              #{ NUMBERS_AND_LETTERS_REGEXP }
+              #{ QUOTE_REGEXP }
+            /x.cs__freeze
+            NOSQL_NUMERIC_REGEXP = /
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ NUMBERS_AND_LETTERS_REGEXP }
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ COMPARISON_REGEXP }
+              #{ ZERO_OR_MORE_SPACES_REGEXP }
+              #{ NUMBERS_AND_LETTERS_REGEXP }
+            /x.cs__freeze
+
+            NOSQL_DEFINITE_THRESHOLD = 3
+            NOSQL_WORTH_WATCHING_THRESHOLD = 1
+            NOSQL_CONFIDENCE_THRESHOLD = 3
+            MAX_DISTANCE = 10
+            DEFAULT_RULE_DEFINITIONS = [
+              {
+                  keywords: [],
+                  name: 'nosql-injection',
+                  patterns: [
+                    {
+                        caseSensitive: false,
+                        id: 'NO-SQLI-1',
+                        score: 1,
+                        value: '(?:\\{\\s*\".*\"\\s*:.*\\})'
+                    },
+                    {
+                        id: 'NO-SQLI-2',
+                        caseSensitive: true,
+                        score: 3,
+                        value: "(?:\"|')?\\$(?:gte|gt|lt|lte|eq|ne|in|nin|where|mod|all|size|exists|type|slice|or)(?:\"|')?\\s*:.*" # rubocop:disable Layout/LineLength
+                    }
+                  ]
+              }
+            ].cs__freeze
+
+            private
+
+            # Creates a new instance of InputAnalysisResult with basic info.
+            #
+            # @param rule_id [String] The name of the Protect Rule.
+            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+            # @param score_level [Contrast::Agent::Reporting::ScoreLevel] the score tag after analysis.
+            # @param value [String, Array<String>] the value of the input.
+            # @param path [String] the path of the current request context.
+            #
+            # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
+            def new_ia_result rule_id, input_type, score_level, path, value
+              super(rule_id, input_type, path, value).tap { |res| res.score_level = score_level }
+            end
+
+            # This methods checks if input should be tagged DEFINITEATTACK, WORTHWATCHING, or IGNORE,
+            # and creates a new instance of InputAnalysisResult.
+            #
+            # @param request [Contrast::Agent::Request] the current request context.
+            # @param rule_id [String] The name of the Protect Rule.
+            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+            # @param value [String, Array<String>] the value of the input.
+            #
+            # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
+            def create_new_input_result request, rule_id, input_type, value
+              score = evaluate_patterns(value)
+              score = evaluate_rules(value, score)
+
+              score_level = if definite_attack?(score)
+                              DEFINITEATTACK
+                            elsif worth_watching?(score)
+                              WORTHWATCHING
+                            else
+                              IGNORE
+                            end
+              result = new_ia_result(rule_id, input_type, score_level, request.path, value)
+              add_needed_key(request, result, input_type, value)
+              result
+            end
+
+            # This method evaluates the patterns relevant to NoSQL Injection to check whether
+            # the input is matched by any of them. The total score of all patterns matched is
+            # returned, unless the individual matching pattern score matches or exceeds
+            # NOSQL_CONFIDENCE_THRESHOLD *and* the total score for all evaluations matches or
+            # exceeds NOSQL_DEFINITE_THRESHOLD, in which case the total score achieved to that
+            # point is returned.
+            #
+            # @param value [String] the value of the input.
+            # @param total_score [Integer] the total score thus far.
+            #
+            # @return res [Integer]
+            def evaluate_patterns value, total_score = 0
+              applicable_patterns = nosqli_patterns
+              return total_score if applicable_patterns.nil?
+
+              total_patterns_score = 0
+              applicable_patterns.each do |pattern|
+                next unless value.match?(pattern[:value])
+
+                total_patterns_score += pattern[:score].to_i
+                total_score += pattern[:score].to_i
+
+                if pattern[:score].to_i >= NOSQL_CONFIDENCE_THRESHOLD && definite_attack?(total_score)
+                  return total_score
+                end
+              end
+
+              total_score
+            end
+
+            def evaluate_comment_rule value
+              (value =~ NOSQL_COMMENT_REGEXP).nil? ? 0 : 2 # None/Medium
+            end
+
+            # This method evaluates the searcher rules relevant to NoSQL Injection to check whether
+            # the input is matched by any of them. The total score of all rules matched is
+            # returned, unless the individual matching rukle score matches or exceeds
+            # NOSQL_CONFIDENCE_THRESHOLD *and* the total score for all evaluations matches or
+            # exceeds NOSQL_DEFINITE_THRESHOLD, in which case the total score achieved to that
+            # point is returned.
+            #
+            # @param value [String] the value of the input.
+            # @param total_score [Integer] the total score thus far.
+            #
+            # @return res [Integer]
+            def evaluate_rules value, total_score = 0
+              total_rules_score = 0
+              %i[evaluate_comment_rule evaluate_or_rule].each do |method|
+                rule_score = send(method, value)
+                total_rules_score += rule_score
+                total_score += rule_score
+
+                return total_score if rule_score >= NOSQL_CONFIDENCE_THRESHOLD && definite_attack?(total_score)
+              end
+
+              total_score
+            end
+
+            # This method evaluates the input value for NoSQL Or searches. Each possible match is
+            # checked. If a match is found then a score of either 3 (High) or 4 (Critical) will
+            # be returned, depending on whether the regexp for finding comments is also matched.
+            #
+            # @param value [String] the value of the input.
+            #
+            # @return res [Integer]
+            def evaluate_or_rule value
+              score = 0
+
+              locs = matches_by_position(value, NOSQL_OR_REGEXP)
+              return score if locs.empty?
+
+              locs.each do |loc|
+                [NOSQL_QUOTED_REGEXP, NOSQL_NUMERIC_REGEXP].each do |pattern|
+                  pattern_locs = matches_by_position(value[loc[1]..], pattern)
+                  next unless !pattern_locs.empty? && pattern_locs[0][0] < MAX_DISTANCE
+
+                  return 4 if value.match?(NOSQL_COMMENTS_AFTER_REGEXP, loc[1] + pattern_locs[0][1]) # Critical
+
+                  score = 3 # High
+                  break
+                end
+              end
+
+              score
+            end
+
+            # This method returns the patterns to be checked against the input value.
+            #
+            # @return res [Array, nil]
+            def nosqli_patterns
+              server_features = Contrast::Agent::Reporting::Settings::ServerFeatures.new
+              rule_definitions = server_features&.protect&.rule_definition_list
+              rule_definitions = DEFAULT_RULE_DEFINITIONS if rule_definitions.empty?
+              rule_definitions.find { |r| r[:name] == Contrast::Agent::Protect::Rule::NoSqli::NAME }&.dig(:patterns)
+            end
+
+            def matches_by_position value, pattern
+              value.to_enum(:scan, pattern).map { Regexp.last_match.offset(Regexp.last_match.size - 1) }
+            end
+
+            def definite_attack? score
+              score >= NOSQL_DEFINITE_THRESHOLD
+            end
+
+            def worth_watching? score
+              score >= NOSQL_WORTH_WATCHING_THRESHOLD
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/{path_traversal.rb → path_traversal/path_traversal.rb}

@@ -1,8 +1,15 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/utils/stack_trace_utils'
+require 'contrast/agent/reporting/details/path_traversal_details'
+require 'contrast/agent/reporting/details/path_traversal_semantic_analysis_details'
+require 'contrast/agent/protect/rule/path_traversal/path_traversal_input_classification'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Agent
@@ -10,30 +17,37 @@ module Contrast
       module Rule
         # This class handles our implementation of the Path Traversal
         # Protect rule.
-        class PathTraversal < Contrast::Agent::Protect::Rule::BaseService
-          include Contrast::Components::Interface
-          access_component :logging, :agent
+        class PathTraversal < Contrast::Agent::Protect::Rule::Base
+          include Contrast::Agent::Reporting::InputType
 
           NAME = 'path-traversal'
-          SYSTEM_PATHS = %w[
-            /proc/self
-            etc/passwd
-            etc/shadow
-            etc/hosts
-            etc/groups
-            etc/gshadow
-            ntuser.dat
-            /Windows/win.ini
-            /windows/system32/
-            /windows/repair/
+          APPLICABLE_USER_INPUTS = [
+            BODY, COOKIE_NAME, COOKIE_VALUE, HEADER, PARAMETER_VALUE, PARAMETER_NAME,
+            JSON_VALUE, MULTIPART_VALUE, MULTIPART_FIELD_NAME, XML_VALUE, DWR_VALUE, URI
           ].cs__freeze
 
-          KNOWN_SECURITY_BYPASS_MARKERS = ['::$DATA', '::$Index', '', '\x00'].cs__freeze
-
-          def name
+          def rule_name
             NAME
           end
 
+          # Array of sub_rules
+          #
+          # @return [Array]
+          def sub_rules
+            @_sub_rules ||= [Contrast::Agent::Protect::Rule::PathTraversalSemanticBypass.new].cs__freeze
+          end
+
+          def applicable_user_inputs
+            APPLICABLE_USER_INPUTS
+          end
+
+          # Path Traversal input classification
+          #
+          # @return [module<Contrast::Agent::Protect::Rule::PathTraversalInputClassification>]
+          def classification
+            @_classification ||= Contrast::Agent::Protect::Rule::PathTraversalInputClassification.cs__freeze
+          end
+
           def infilter context, method, path
             return unless infilter?(context)
 
@@ -43,9 +57,10 @@ module Contrast
             append_to_activity(context, result)
             return unless blocked?
 
-            raise Contrast::SecurityException.new(
-                self,
-                "Path Traversal rule triggered. Call to File.#{ method } blocked.")
+            result_rule_name = Contrast::Utils::StringUtils.transform_string(result.rule_id)
+            cef_logging(result, :successful_attack, value: path)
+            exception_messasge = "#{ result_rule_name } rule triggered. Call to File.#{ method } blocked."
+            raise(Contrast::SecurityException.new(self, exception_messasge))
           end
 
           protected
@@ -53,41 +68,30 @@ module Contrast
           def find_attacker context, path
             attack_result = nil
             attack_result = super(context, path) if infilter?(context)
-            attack_result = check_rep_features(context, path, attack_result)
-            attack_result
+            check_rep_features(context, path, attack_result)
           end
 
           # Build a subclass of the RaspRuleSample using the query string and the
           # evaluation
           def build_sample context, input_analysis_result, path, **_kwargs
             sample = build_base_sample(context, input_analysis_result)
-            sample.path_traversal = Contrast::Api::Dtm::PathTraversalDetails.new
+            sample.details = Contrast::Agent::Reporting::Details::PathTraversalDetails.new
             path ||= input_analysis_result.value
-            sample.path_traversal.path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
+            sample.details.path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
             sample
           end
 
           private
 
           # Build a subclass of the RaspRuleSample if the sample matches
-          # TODO: SPEED-? delete me when implemented in Speedracer.
-          #   this implementation duplicates logic that is moving to Speedracer
-          #   the reason it is still here is Speedracer doesn't yet have a method to correlate
-          #   and (update) attack results that are generated because the evaluation results
-          #   from REP, it can only forward the attack results are generated by the agent.
           def build_rep_sample context, path
             sample = build_base_sample(context, nil)
-            sample.path_traversal_semantic = Contrast::Api::Dtm::PathTraversalSemanticAnalysisDetails.new
+            sample.details = Contrast::Agent::Reporting::Details::PathTraversalSemanticAnalysisDetails.new
             path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
-            sample.path_traversal_semantic.path = path
-
-            if custom_code_access_sysfile_enabled? && custom_code_accessing_system_file?(path)
-              sample.path_traversal_semantic.findings << :CUSTOM_CODE_ACCESSING_SYSTEM_FILES
-              return sample
-            end
+            sample.details.path = path
 
             if common_file_exploits_enabled? && contains_known_attack_signatures?(path)
-              sample.path_traversal_semantic.findings << :COMMON_FILE_EXPLOITS
+              sample.details.findings << :COMMON_FILE_EXPLOITS
               return sample
             end
 
@@ -103,24 +107,12 @@ module Contrast
             attack_result
           end
 
-          def custom_code_access_sysfile_enabled?
-            AGENT.report_custom_code_sysfile_access?
-          end
-
-          def custom_code_accessing_system_file? input
-            system_file?(input) && Contrast::Utils::StackTraceUtils.custom_code_context?
-          end
-
-          def system_file? path
-            return false unless path
-
-            SYSTEM_PATHS.any? { |sys_path| sys_path.include?(path) }
-          end
-
           def common_file_exploits_enabled?
             false
           end
 
+          # TODO: RUBY-318
+          # KNOWN_SECURITY_BYPASS_MARKERS = ['::$DATA', '::$Index', '', '\x00'].cs__freeze
           def contains_known_attack_signatures? input
             utf8 = Contrast::Utils::StringUtils.force_utf8(input)
             _ = CGI.unescape(utf8)
@@ -133,7 +125,8 @@ module Contrast
             #     return 'NUL' in str(e) or 'null byte' in str(e) or (PY34 and 'embedded NUL character' == str(e))
             #   except Exception as e:
             #     return 'null byte' in str(e).lower()
-            #   return return any([bypass_markers.lower().rstrip('/') in realpath for bypass_markers in PathTraversalREPMixin.KNOWN_SECURITY_BYPASS_MARKERS])
+            #   return return any([bypass_markers.lower().rstrip('/') in realpath for bypass_markers in
+            #   PathTraversalREPMixin.KNOWN_SECURITY_BYPASS_MARKERS])
             false
           end
         end

data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/input_classification_base'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Path Traversal rule
+        # Input classification
+        module PathTraversalInputClassification
+          PATH_TRAVERSAL_MATCH = 'path-traversal-input-tracing-v1'
+          WORTHWATCHING_MATCH = 'path-traversal-worth-watching-v2'
+
+          THRESHOLD = 90.cs__freeze
+          class << self
+            include InputClassificationBase
+
+            private
+
+            # This methods checks if input is tagged DEFINITEATTACK or IGNORE matches value with it's
+            # key if needed and Creates new isntance of InputAnalysisResult.
+            #
+            # @param request [Contrast::Agent::Request] the current request context.
+            # @param rule_id [String] The name of the Protect Rule.
+            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+            # @param value [String, Array<String>] the value of the input.
+            #
+            # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
+            def create_new_input_result request, rule_id, input_type, value
+              return unless Contrast::AGENT_LIB
+
+              input_eval = Contrast::AGENT_LIB.eval_input(value,
+                                                          convert_input_type(input_type),
+                                                          Contrast::AGENT_LIB.rule_set[rule_id],
+                                                          Contrast::AGENT_LIB.eval_option[:PREFER_WORTH_WATCHING])
+
+              ia_result = new_ia_result(rule_id, input_type, request.path, value)
+              score = input_eval&.score || 0
+              if score >= THRESHOLD
+                ia_result.score_level = DEFINITEATTACK
+                ia_result.ids << PATH_TRAVERSAL_MATCH
+              elsif score == 10
+                # There is one pattern to match 10 and thus on its own will be reported as a probe.
+                # This rule can report WORTHWATCHING:
+                # https://protect-spec.prod.dotnet.contsec.com/rules/path-traversal.html#applicable-input-types
+                ia_result.score_level = WORTHWATCHING
+                ia_result.ids << WORTHWATCHING_MATCH
+              else
+                ia_result.score_level = IGNORE
+              end
+              add_needed_key(request, ia_result, input_type, value)
+              ia_result
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb

@@ -0,0 +1,139 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/reporting/details/path_traversal_semantic_analysis_details'
+require 'contrast/agent/request/request_context'
+require 'contrast/utils/string_utils'
+require 'contrast/agent_lib/api/path_semantic_file_security_bypass'
+require 'contrast/agent_lib/interface'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Path Traversal Semantic
+        # Bypass sub-rule. This rule should report the attack result
+        class PathTraversalSemanticBypass < Contrast::Agent::Protect::Rule::Base
+          NAME = 'path-traversal-semantic-file-security-bypass'
+          SYSTEM_PATHS = %w[
+            /proc/self
+            etc/passwd
+            etc/shadow
+            etc/hosts
+            etc/groups
+            etc/gshadow
+            ntuser.dat
+            /Windows/win.ini
+            /windows/system32/
+            /windows/repair/
+          ].cs__freeze
+
+          def rule_name
+            NAME
+          end
+
+          def sub_rules
+            Contrast::Utils::ObjectShare::EMPTY_ARRAY
+          end
+
+          # Path traversal Semantic infilter:
+          # This rule does not have input classification.
+          #
+          # @param context [Contrast::Agent::RequestContext] current request contest
+          # @param method [String] name of the method triggering the rule
+          # @param path [String] potential dangerous path
+          # @raise [Contrast::SecurityException] if the rule mode ise set
+          # to BLOCK and valid cdmi is detected.
+          def infilter context, method, path
+            return if protect_excluded_by_url?(rule_name, context.request.path)
+            return unless rule_violated?(path)
+
+            result = build_violation(context, path)
+            return unless result
+
+            append_to_activity(context, result)
+            return unless blocked?
+
+            result_rule_name = Contrast::Utils::StringUtils.transform_string(result.rule_id)
+            cef_logging(result, :successful_attack, value: path)
+            exception_messasge = "#{ result_rule_name } rule triggered. Call to File.#{ method } blocked."
+            raise(Contrast::SecurityException.new(self, exception_messasge))
+          end
+
+          protected
+
+          # Check if semantic file security bypass is detected
+          #
+          # @param file_path [String] command to check.
+          # @param is_custom_code[String] whether the file is being accessed by custom (user) code,
+          #     rather than framework code
+          # @return result[Integer, nil] returns:
+          #     1 => security bypass is detected.
+          #     0 => no security bypass is detected.
+          def file_security_bypassed? file_path, is_custom_code = nil
+            return false unless (agent_lib = Contrast::AGENT_LIB) || file_path
+
+            custom_call = is_custom_code.nil? ? 0 : 1
+
+            agent_lib.check_path_semantic_security_bypass(file_path, custom_call) == 1
+          end
+
+          def rule_violated? path
+            return false if custom_code_access_sysfile_enabled?
+
+            is_custom_code = custom_code_accessing_system_file?(path)
+            is_custom_code || file_security_bypassed?(path, is_custom_code)
+          end
+
+          def build_sample context, _input_analysis_result, path, **_kwargs
+            sample = build_base_sample(context, nil)
+            sample.details = Contrast::Agent::Reporting::Details::PathTraversalSemanticAnalysisDetails.new
+            path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
+            sample.details.path = path
+
+            is_custom_code = custom_code_accessing_system_file?(path)
+            # This should catch all the types of security breaches in that sub-rule scope
+            # but apparently it's not, because some of the system files is being skipped and not detected,
+            # but for our previous logic - it was expected for certain files to be detected and blocked
+            security_bypassed = file_security_bypassed?(path, is_custom_code)
+
+            # if agent lib sub-rule returns true and is custom code -> assign and report
+            if security_bypassed
+              if is_custom_code
+                sample.details.findings << :CUSTOM_CODE_ACCESSING_SYSTEM_FILES
+                sample.details.findings << :COMMON_FILE_EXPLOITS if common_file_exploits_enabled?
+              end
+              return sample
+            end
+
+            if is_custom_code
+              sample.details.findings << :CUSTOM_CODE_ACCESSING_SYSTEM_FILES
+              return sample
+            end
+
+            nil
+          end
+
+          def custom_code_access_sysfile_enabled?
+            ::Contrast::PROTECT.report_custom_code_sysfile_access?
+          end
+
+          def custom_code_accessing_system_file? input
+            system_file?(input) && Contrast::Utils::StackTraceUtils.custom_code_context?
+          end
+
+          def system_file? path
+            return false unless path
+
+            SYSTEM_PATHS.any? { |sys_path| sys_path.include?(path) }
+          end
+
+          def common_file_exploits_enabled?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This class is the concrete implementation of the DefaultSqlScanner designed

data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb

@@ -1,8 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 
 module Contrast
   module Agent