contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb

@@ -0,0 +1,86 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/timer'
+require 'contrast/agent/reporting/attack_result/user_input'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/details/protect_rule_details'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample_stack'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the new RaspRuleSample.
+      # It is mainly used to build samples for each
+      # protect rule, and translate data from SP IA.
+      # It is not a reporting event.
+      class RaspRuleSample
+        # Any rules specific details
+        #
+        # @return [Contrast::Agent::Reporting::Details::ProtectRuleDetails, nil]
+        attr_accessor :details
+
+        class << self
+          # @param context [Contrast::Agent::RequestContext]
+          # @param ia_result [Contrast::Agent::Reporting::Settings::InputAnalysisResult] the analysis of the input that
+          #   was determined to be an attack
+          # @return [Contrast::Agent::Reporting::RaspRuleSample]
+          def build context, ia_result
+            sample = new
+            sample.time_stamp = context&.timer&.start_ms || Contrast::Utils::Timer.now_ms
+            sample.user_input = build_user_input_from_ia(ia_result)
+            sample.user_input.document_type = if context&.request
+                                                Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
+                                              end
+            sample
+          end
+
+          # @param ia_result [Contrast::Agent::Reporting::Settings::InputAnalysisResult] the analysis of the input that
+          #   was determined to be an attack
+          def build_user_input_from_ia ia_result
+            user_input = Contrast::Agent::Reporting::UserInput.new
+            return user_input unless ia_result
+
+            user_input.input_type = ia_result.input_type
+            user_input.matcher_ids = ia_result.ids
+            user_input.path = ia_result.path
+            user_input.key = ia_result.key if ia_result.key
+            user_input.value = ia_result.value if ia_result.value
+            user_input
+          end
+        end
+
+        def time_stamp
+          @_time_stamp ||= Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
+        end
+
+        def time_stamp= timestamp_ms
+          @_time_stamp = timestamp_ms
+        end
+
+        def user_input
+          @_user_input ||= Contrast::Agent::Reporting::UserInput.new
+        end
+
+        def user_input= input
+          @_user_input = input if input.is_a?(Contrast::Agent::Reporting::UserInput)
+        end
+
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>,Array]
+        def stack
+          @_stack ||= []
+        end
+
+        def to_controlled_hash
+          {
+              timeStamp: Time.at(time_stamp).iso8601,
+              userInput: user_input.to_controlled_hash,
+              details: details&.to_controlled_hash,
+              stack: stack.map(&:to_controlled_hash)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/attack_result/response_type.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the response types used to generate
+      # attack result.
+      module ResponseType
+        BLOCKED               = :BLOCKED.cs__freeze
+        MONITORED             = :MONITORED.cs__freeze
+        PROBED                = :PROBED.cs__freeze
+        BLOCKED_AT_PERIMETER  = :BLOCKED_AT_PERIMETER.cs__freeze
+        SUSPICIOUS            = :SUSPICIOUS.cs__freeze
+        AGGREGATED            = :AGGREGATED.cs__freeze
+        EXPLOITED             = :EXPLOITED.cs__freeze
+        NO_ACTION             = :NO_ACTION.cs__freeze
+
+        class << self
+          def to_a
+            [NO_ACTION, BLOCKED, MONITORED, PROBED, BLOCKED_AT_PERIMETER, EXPLOITED, SUSPICIOUS, AGGREGATED]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/attack_result/user_input.rb

@@ -0,0 +1,97 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/input_analysis/input_type'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the new Sqli detail used by RaspRuleSample
+      class UserInput
+        INPUT_TYPE = Contrast::Agent::Reporting::InputType
+        DOCUMENT_TYPE = { XML: :XML, JSON: :JSON, NORMAL: :NORMAL }.cs__freeze
+
+        # @return @_path [String]
+        def path
+          @_path ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param path [String]
+        # @return @_path [String]
+        def path= path
+          @_path = path if path.is_a?(String)
+        end
+
+        # @return @_key [String]
+        def key
+          @_key ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param key [String]
+        # @return @_key [String]
+        def key= key
+          @_key = key if key.is_a?(String)
+        end
+
+        # @return value [String]
+        def value
+          @_value ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param value [String]
+        # @return value [String]
+        def value= value
+          @_value = value if value.is_a?(String)
+        end
+
+        # @return @_input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        def input_type
+          @_input_type ||= INPUT_TYPE::UNDEFINED_TYPE
+        end
+
+        # @param input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        # @return @_input_type [
+        # Symbol<Contrast::Agent::Reporting::Settings::InputAnalysis::InputAnalysisResult::InputType>]
+        def input_type= input_type
+          @_input_type = input_type if INPUT_TYPE.to_a.include?(input_type)
+        end
+
+        # type [Symbol<:XML, :JSON, :NORMAL>]
+        def document_type
+          @_document_type ||= DOCUMENT_TYPE[:NORMAL]
+        end
+
+        def document_type= type
+          @_document_type = type if DOCUMENT_TYPE.value?(type)
+        end
+
+        # Matchers IDs
+        # @return @_ids [Array<String>]
+        def matcher_ids
+          @_matcher_ids ||= []
+        end
+
+        # Matchers IDs
+        # @param ids [Array<String>]
+        # @return @_ids [Array<String>]
+        def matcher_ids= ids
+          @_matcher_ids = ids if ids.is_a?(Array) && ids.any?(String)
+        end
+
+        def to_controlled_hash
+          {
+              path: path,
+              key: key,
+              value: value,
+              inputType: input_type.to_s,
+              documentType: document_type.to_s,
+              matcherIds: matcher_ids&.map(&:to_s)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/connection_status.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # Keeps track of the state of connections to TeamServer.
+      class ConnectionStatus
+        def initialize
+          @last_success = nil
+          @last_failure = nil
+          @startup_messages_sent = false
+          @_startup_server_message_sent = false
+        end
+
+        # Whether we have sent startup message to TeamServer. True after successfully sending startup messages to
+        # TeamServer and reset to false if we lose connection.
+        #
+        # @return [Boolean]
+        def startup_messages_sent?
+          @startup_messages_sent
+        end
+
+        # The last message sent was successful or not
+        #
+        # @return [Boolean]
+        def connected?
+          @last_success && (@last_failure.nil? || @last_success > @last_failure)
+        end
+
+        # The current state of the TeamServer is active with a successful message sent
+        def success!
+          @startup_messages_sent = true
+          @last_success = Time.now.to_f
+        end
+
+        # The TeamServer may be in some sort of error state
+        def failure!
+          @startup_messages_sent = false
+          @last_failure = Time.now.to_f
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/bot_blocker_details.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Bot blocker IA result details info.
+        class BotBlockerDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :bot
+          # User agent header value
+          #
+          # @return [String]
+          attr_accessor :user_agent
+
+          def to_controlled_hash
+            {
+                bot: bot,
+                userAgent: user_agent
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/cmd_injection_details.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # CMDI IA result details info.
+        class CmdInjectionDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :cmd
+          # @return [Integer]
+          attr_accessor :start_idx
+          # @return [Integer]
+          attr_accessor :end_idx
+
+          def to_controlled_hash
+            {
+                command: cmd,
+                startIndex: start_idx,
+                endIndex: end_idx
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/details.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/bot_blocker_details'
+require 'contrast/agent/reporting/details/cmd_injection_details'
+require 'contrast/agent/reporting/details/no_sqli_details'
+require 'contrast/agent/reporting/details/path_traversal_details'
+require 'contrast/agent/reporting/details/protect_rule_details'
+require 'contrast/agent/reporting/details/sqli_details'
+require 'contrast/agent/reporting/details/untrusted_deserialization_details'
+require 'contrast/agent/reporting/details/xss_match'
+require 'contrast/agent/reporting/details/xss_details'
+require 'contrast/agent/reporting/details/xxe_details'
+require 'contrast/agent/reporting/details/xxe_match'
+require 'contrast/agent/reporting/details/xxe_wrapper'
+require 'contrast/agent/reporting/details/virtual_patch_details'
+require 'contrast/agent/reporting/details/ip_denylist_details'

data/lib/contrast/agent/reporting/details/ip_denylist_details.rb

@@ -0,0 +1,35 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Bot blocker IA result details info.
+        class IpDenylistDetails < ProtectRuleDetails
+          # @return [String]
+          attr_reader :ip
+          # @return [String]
+          attr_reader :uuid
+
+          # @param ip [String] the IP address that was blocked
+          # @param uuid [String] the UUID to identify the block rule in TeamServer
+          def initialize ip, uuid
+            @ip = ip
+            @uuid = uuid
+            super()
+          end
+
+          def to_controlled_hash
+            {
+                ip: ip,
+                uuid: uuid
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/no_sqli_details.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # NoSqliDetails IA result details info.
+        class NoSqliDetails < ProtectRuleDetails
+          # @return [Integer]
+          attr_accessor :start_idx
+          # @return [Integer]
+          attr_accessor :end_idx
+          # @return [Integer]
+          attr_accessor :boundary_overrun_idx
+          # @return [Integer]
+          attr_accessor :input_boundary_idx
+          # @return [String]
+          attr_accessor :query
+
+          def to_controlled_hash
+            {
+                start: start_idx,
+                end: end_idx,
+                boundaryOverrunIndex: boundary_overrun_idx,
+                inputBoundaryIndex: input_boundary_idx,
+                query: query
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/path_traversal_details.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # PathTraversalDetails IA result details info.
+        class PathTraversalDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :path
+
+          def to_controlled_hash
+            {
+                path: path
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/path_traversal_semantic_analysis_details.rb

@@ -0,0 +1,32 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # PathTraversalDetails IA result details info.
+        class PathTraversalSemanticAnalysisDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :path
+          # @return [Array<Symbol>]
+          attr_accessor :findings
+
+          def initialize
+            @findings = []
+            super
+          end
+
+          def to_controlled_hash
+            {
+                path: path,
+                findings: findings&.map(&:to_s)
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/protect_rule_details.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # This class is holding additional info which is rule specific and this is
+        # the base class for type check made easy.
+        class ProtectRuleDetails
+          # Extend per each rule.
+          def to_controlled_hash; end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/sqli_dangerous_functions.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # SqliDangerousFunctions IA result details info.
+        class SqliDangerousFunctions < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :query
+
+          def to_controlled_hash
+            { query: query }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/sqli_details.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # SqliDetails IA result details info.
+        class SqliDetails < ProtectRuleDetails
+          # @return [Integer]
+          attr_accessor :start_idx
+          # @return [Integer]
+          attr_accessor :end_idx
+          # @return [Integer]
+          attr_accessor :boundary_overrun_idx
+          # @return [Integer]
+          attr_accessor :input_boundary_idx
+          # @return [String]
+          attr_accessor :query
+
+          def to_controlled_hash
+            {
+                start: start_idx,
+                end: end_idx,
+                boundaryOverrunIndex: boundary_overrun_idx,
+                inputBoundaryIndex: input_boundary_idx,
+                query: query
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/untrusted_deserialization_details.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Untrusted Deserialization IA result details info.
+        class UntrustedDeserializationDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :cmd
+          # @return [String]
+          attr_accessor :deserializer
+
+          def to_controlled_hash
+            {
+                command: cmd,
+                deserializer: deserializer
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/virtual_patch_details.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Virtual Patch IA result details info.
+        class VirtualPatchDetails < ProtectRuleDetails
+          # @return [String]
+          attr_reader :uuid
+
+          # @param uuid [String] the UUID to identify the block rule in TeamServer
+          def initialize uuid
+            @uuid = uuid
+            super()
+          end
+
+          def to_controlled_hash
+            {
+                uuid: uuid
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/xss_details.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+require 'contrast/agent/reporting/details/xss_match'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # XssDetails IA result details info.
+        class XssDetails < ProtectRuleDetails
+          # @return [String]
+          attr_accessor :input
+          # @return [<Array<Contrast::Agent::Reporting::XssMatch>]
+          attr_accessor :matches
+
+          def initialize
+            @matches = []
+            super
+          end
+
+          def to_controlled_hash
+            {
+                input: input,
+                matches: matches&.map(&:to_controlled_hash)
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/details/xss_match.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/protect_rule_details'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Details
+        # Matcher data for XSS rule.
+        class XssMatch
+          # @return [Integer] in ms
+          attr_accessor :evidence_start
+          # @return [String]
+          attr_accessor :evidence
+          # @return [Integer]
+          attr_accessor :offset
+
+          def to_controlled_hash
+            {
+                evidenceStart: evidence_start,
+                evidence: evidence,
+                offset: offset
+            }
+          end
+        end
+      end
+    end
+  end
+end