contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/reporting_utilities/ng_response_extractor.rb

@@ -0,0 +1,137 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the methods for TS response conversion to settings objects. It is used for those
+      # endpoints which have NG in their prefix.
+      module NgResponseExtractor
+        private
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_assess response_data, res
+          assessments = response_data[:settings][:assessment]
+          return unless assessments
+
+          res.application_settings.assess.session_id = assessments[:session_id]
+          disabled = assessments[:disabledRules]
+          return unless disabled
+
+          disabled.each do |rule_id|
+            rule_setting = Contrast::Agent::Reporting::Settings::AssessRule.new.tap { |setting| setting.enable = false }
+            res.application_settings.assess.rule_settings[rule_id] = rule_setting
+          end
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_protect response_data, res
+          protect = response_data[:settings][:defend]
+          return unless protect
+
+          res.application_settings.protect.protection_rules = protect[:protectionRules]
+          protect[:virtualPatches]&.each do |patch_json|
+            res.application_settings.protect.virtual_patches <<
+                Contrast::Agent::Reporting::Settings::VirtualPatch.new(patch_json)
+          end
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_exclusions response_data, res
+          exclusions = response_data[:settings][:exceptions]
+          return unless exclusions
+
+          # Pass true if the endpoint is ng.
+          res.application_settings.exclusions.input_exclusions = [exclusions[:inputExceptions], true]
+          res.application_settings.exclusions.url_exclusions = [exclusions[:urlExceptions], true]
+        end
+
+        # The responses we receive for feature and settings from TS have different
+        # place to store these reactions: body.reactions vs body.settings.reactions.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_reactions response_data, res
+          res.reactions = response_data[:settings][:reactions] if response_data[:settings]
+          res.reactions = response_data[:reactions] if response_data[:features]
+        end
+
+        # This method is universal and used for both ng endpoint of feature settings and the new
+        # Server settings endpoint. Used in both build_feature_settings and build_server_settings.
+        # Passing the ng_ flag determines the use of the endpoint and response used because some of
+        # the response fields are with different names or do not exist: [enabled vs enable]
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_assess_features response_data, res
+          assess = response_data[:features][:assessment]
+          return unless assess
+
+          res.server_features.assess.enabled = assess[:enabled]
+          res.server_features.assess.sampling = assess[:sampling]
+          res.server_features.assess.sanitizers = assess[:sanitizers]
+          res.server_features.assess.validators = assess[:validators]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_protect_features response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.enabled = protect[:enabled]
+          res.server_features.protect.bot_blocker.enable = protect[:'bot-blocker']
+          res.server_features.protect.bot_blocker.bots = protect[:botBlockers]
+          ng_extract_syslog(response_data, res)
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_syslog response_data, res
+          return unless (syslog = response_data[:features][:defend][:syslog])
+
+          res.server_features.protect.syslog.assign_array(syslog, ng_: true)
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_protect_lists response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.ip_allowlist = protect[:ipAllowlist]
+          res.server_features.protect.ip_denylist = protect[:ipDenylist]
+          res.server_features.protect.log_enhancers = protect[:logEnhancers]
+          res.server_features.protect.ng_rule_definition_list(protect[:ruleDefinitionList])
+        end
+
+        # Here we extract the rules and state for the sensitive data masking policy
+        # received from TS.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_sensitive_data_policy response_data, res
+          return unless (sensitive_data = response_data[:settings][:sensitive_data_masking_policy])
+
+          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
+          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
+          res.application_settings.sensitive_data_masking.build_rules_form_settings(sensitive_data[:rules])
+        end
+
+        # Here we extract the log settings received from TS.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def ng_extract_log_settings response_data, res
+          return unless (log_level = response_data[:logLevel])
+
+          res.server_features.log_level = log_level
+          res.server_features.log_file = response_data[:logFile] if response_data[:logFile]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb

@@ -0,0 +1,138 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'json'
+require 'net/http'
+require 'contrast/components/logger'
+require 'contrast/utils/net_http_base'
+require 'contrast/agent/reporting/connection_status'
+require 'contrast/agent/reporting/reporting_utilities/response_handler'
+require 'contrast/agent/reporting/reporting_utilities/reporter_client_utils'
+require 'contrast/agent/reporting/reporting_utilities/endpoints'
+require 'contrast/agent/reporting/reporting_utilities/headers'
+require 'contrast/agent/reporting/reporting_events/server_settings'
+require 'contrast/agent/reporting/reporting_events/application_settings'
+require 'contrast/config/diagnostics'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class creates a Net::HTTP client and initiates a connection to the provided result
+      # @attr_reader headers [Contrast::Agent::Reporting::Headers]
+      class ReporterClient < Contrast::Utils::NetHttpBase
+        attr_reader :headers
+
+        include Contrast::Agent::Reporting::Endpoints
+        include Contrast::Agent::Reporting::ReporterClientUtils
+        include Contrast::Agent::Reporting::ResponseHandlerUtils
+        include Contrast::Components::Logger::InstanceMethods
+
+        # @return [Array<Class>] events that may result in configuration changes
+        RECORDABLE_EVENTS = [
+          Contrast::Agent::Reporting::ServerSettings,
+          Contrast::Agent::Reporting::ApplicationSettings,
+          Contrast::Agent::Reporting::AgentStartup,
+          Contrast::Agent::Reporting::ApplicationStartup
+        ].cs__freeze
+        SERVICE_NAME = 'Reporter'
+        REPORT_CONFIG_WHEN = %w[200 304].cs__freeze
+
+        def initialize
+          @headers = Contrast::Agent::Reporting::Headers.new
+          super()
+        end
+
+        # This method initializes the Net::HTTP client we'll need. it will validate
+        # the connection and make the first request. If connection is valid and response
+        # is available then the open connection is returned.
+        #
+        # @return [Net::HTTP, nil] Return open connection or nil
+        def initialize_connection
+          # for this client we would use proxy and custom certificate file if available
+          super(SERVICE_NAME, Contrast::API.api_url, use_proxy: true, use_custom_cert: true)
+        end
+
+        # Start the client for first time and sent startup event
+        #
+        # @param connection [Net::HTTP] open connection
+        def startup! connection
+          return if status.startup_messages_sent?
+
+          send_agent_startup(connection)
+        end
+
+        # Check event type and send it to appropriate TS endpoint
+        #
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
+        # @param connection [Net::HTTP] open connection
+        # @return response [Net::HTTP::Response, nil] response from TS if no response
+        def send_event event, connection
+          return unless connection
+
+          logger.debug('[Reporter] Preparing to send reporting event', event_class: event.cs__class)
+
+          request = build_request(event)
+          response = connection.request(request)
+          audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable
+          process_settings_response(response, event)
+          record_configuration(response, event)
+          process_preflight_response(event, response, connection)
+          response
+        rescue StandardError => e
+          handle_error(event, e)
+        end
+
+        # Write effective config to file:
+        # If we are here the create and server messages are sent and the code received is
+        # 200 or 304. In case of 304 there will be no new settings and we can write current ones.
+        # This is done on every settings request.
+        #
+        # @param response [Contrast::Agent::Reporting::Response, nil]
+        # @param event [Contrast::Agent::Reporting::ReportingEvent]
+        def record_configuration response, event
+          return unless response
+
+          diagnostics.config.determine_config_status(response_handler.last_response_code || response.code)
+          return unless REPORT_CONFIG_WHEN.include?(response_handler.last_response_code || response.code)
+          return unless RECORDABLE_EVENTS.include?(event&.cs__class)
+
+          logger.info('[Reporter Diagnostics] last response code:', response_code: response_handler.last_response_code)
+          diagnostics.write_to_file
+        end
+
+        def status
+          @_status ||= Contrast::Agent::Reporting::ConnectionStatus.new
+        end
+
+        def response_handler
+          @_response_handler ||= Contrast::Agent::Reporting::ResponseHandler.new
+        end
+
+        def diagnostics
+          @_diagnostics ||= Contrast::Agent::DiagnosticsConfig::Diagnostics.new(Contrast::LOGGER.path)
+        end
+
+        def sleep?
+          response_handler.sleep?
+        end
+
+        def timeout
+          response_handler.timeout
+        end
+
+        def mode
+          response_handler.mode
+        end
+
+        def reset_mode
+          response_handler.reset_mode
+        end
+
+        def wake_up
+          response_handler.wake_up
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb

@@ -0,0 +1,161 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'zlib'
+require 'stringio'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporting_events/application_startup'
+require 'contrast/agent/reporting/reporting_utilities/reporter_client'
+require 'contrast/agent/reporting/reporting_utilities/endpoints'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module holds utilities required by the reporting service client
+      module ReporterClientUtils
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Components::Scope::InstanceMethods
+        include Contrast::Agent::Reporting::Endpoints
+
+        # List the events that need to be sent when agent starts up.
+        # The order here matters -- DO NOT CHANGE IT!!! >_< - HM
+        #
+        # If you add more, update the test in reporter_client_spec.rb
+        STARTUP_EVENTS = [
+          Contrast::Agent::Reporting::AgentStartup,
+          Contrast::Agent::Reporting::ApplicationStartup
+        ].cs__freeze
+
+        def audit
+          @_audit ||= Contrast::Agent::Reporting::Audit.new
+        end
+
+        private
+
+        # Send Agent Startup event
+        #
+        # @param connection [Net::HTTP] open connection
+        def send_agent_startup connection
+          logger.debug('Preparing to send startup messages')
+
+          STARTUP_EVENTS.each do |event|
+            startup_event = event.new
+            send_event(startup_event, connection)
+          rescue StandardError => e
+            handle_error(startup_event, e)
+          end
+          logger.debug('Startup messages sent')
+        end
+
+        # This method will build headers of the request required for TS communication
+        #
+        # @param request [Net::HTTPRequest]
+        # @return [Net::HTTPRequest]
+        def build_headers request
+          app_version = @headers.app_version
+          request['API-Key'] = @headers.api_key
+          request['Application-Language'] = @headers.app_language
+          request['Application-Name'] = @headers.app_name
+          request['Application-Path'] = @headers.app_path
+          request['Application-Version'] = app_version if app_version
+          request['Authorization'] = @headers.authorization
+          request['Server-Name'] = @headers.server_name
+          request['Server-Path'] = @headers.server_path
+          request['Server-Type'] = @headers.server_type
+          request['X-Contrast-Agent'] = @headers.agent_version
+          request['X-Contrast-Header-Encoding'] = @headers.encoding
+          build_encode_and_compress_headers(request)
+          request
+        end
+
+        # Handles standard error case, logs and set status for failure
+        #
+        # @param event [Contrast::Agent::Reporting::ReportingEvent]
+        #   One of the DTMs valid for the event field of Contrast::Api::Dtm::Message
+        # @param error_msg [StandardError]
+        # @return nil [NilClass] to be passed as response
+        def handle_error event, error_msg
+          status.failure!
+          logger.error('Unable to send message.',
+                       error_msg,
+                       client: Contrast::Agent::Reporting::ReporterClient::SERVICE_NAME,
+                       event_id: event&.__id__,
+                       event_type: event&.cs__class&.cs__name)
+          nil
+        end
+
+        # Handles response processing and sets status
+        #
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event sent to TeamServer.
+        # @param response [Net::HTTP::Response]
+        def process_settings_response response, event
+          res = response_handler.process(response, event)
+          status.success! if res
+          res
+        end
+
+        # Given a response from preflght, when the finding hash is desired, then send the finding to which it pertains.
+        # The method accepts any Contrast::Agent::Reporting::ReportingEvent, but will short circuit if it is not a
+        # Contrast::Agent::Reporting::Preflight.
+        #
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
+        # @param response [Net::HTTPResponse,nil] The response we handle and read from
+        # @param connection [Net::HTTP] open connection
+        def process_preflight_response event, response, connection
+          return unless event.cs__is_a?(Contrast::Agent::Reporting::Preflight)
+          return unless response&.body && connection
+
+          findings_to_return = response.body.split(',').delete_if { |el| el.include?('*') }
+          findings_to_return.each do |index|
+            preflight_message = event.messages[index.to_i]
+            corresponding_finding = Contrast::Agent::Reporting::ReportingStorage.delete(preflight_message.data)
+            next unless corresponding_finding
+
+            send_event(corresponding_finding, connection)
+          end
+        rescue StandardError => e
+          logger.error('Unable to handle response', e)
+        end
+
+        # Convert the given event into an appropriate Net::HTTPRequest object, setting the request headers and
+        # assigning endpoint the endpoint appropriate for the event and casting its hash to a JSON body.
+        #
+        # @param event event [Contrast::Agent::Reporting::ReportingEvent] The event to send to TeamServer. Really a
+        #   child of the ReportingEvent rather than a literal one.
+        # @return [Net::HTTP::Post,Net::HTTP::Put]
+        def build_request event
+          with_contrast_scope do
+            request = case event.event_method
+                      when :PUT
+                        Net::HTTP::Put.new(event.event_endpoint)
+                      when :GET
+                        Net::HTTP::Get.new(event.event_endpoint)
+                      else # :POST
+                        Net::HTTP::Post.new(event.event_endpoint)
+                      end
+            build_headers(request)
+            event.attach_headers(request)
+            # compress:
+            gzip = Zlib::GzipWriter.new(StringIO.new)
+            gzip << event.event_json
+            request.body = gzip.close.string
+            request
+          end
+        end
+
+        # Adds the compression and encoding Headers required for sending
+        # compress and encoded body payload.
+        #
+        # @param request [Net::HTTPRequest]
+        def build_encode_and_compress_headers request
+          request['Content-Type'] = @headers.content_type
+          request['X-Contrast-Header-Encoding'] = @headers.encoding
+          request['X-Contrast-Encoding'] = @headers.compression
+          request['Content-Encoding'] = @headers.compression
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will be used to store everything that would be sent
+      # and depends on the response we receive
+      module ReportingStorage
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+
+          # So the collection will be used to store those events
+          def collection
+            @_collection ||= {}
+          end
+
+          # @param key[String] the key for the pair
+          # @param value[Object] the value we need to store
+          # @return [Object] the value we saved
+          def []= key, value
+            return unless key
+            return unless value
+
+            logger.debug('Saving new value', key: key)
+
+            key = key.to_s.downcase.strip
+            collection[key] = value
+
+            value # rubocop:disable Lint/Void
+          end
+
+          # @param key[String] the key for the pair
+          def [] key
+            return unless key
+
+            collection[key]
+          end
+          alias_method :get, :[]
+          alias_method :set, :[]=
+
+          def delete key
+            return unless key
+
+            logger.debug('Starting deleting value for', key: key)
+
+            deleted_value = collection.delete(key)
+            logger.debug('Key wasn\'t found') unless deleted_value
+
+            deleted_value
+          end
+
+          # @param rule_id [String] the rule_id
+          # @return [Array, nil] return array with key and value of the pair
+          def find_by_rule_id rule_id
+            return unless rule_id
+
+            collection.find { |_, v| v.rule_id == rule_id }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response.rb

@@ -0,0 +1,98 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/application_settings'
+require 'contrast/agent/reporting/settings/server_features'
+require 'contrast/agent/reporting/settings/reaction'
+
+module Contrast
+  module Agent
+    module Reporting
+      # this class will hold the response from TS
+      class Response
+        # All of the settings from TeamServer that apply at the application level.
+        # At least one, but not necessarily all, setting will differ from the agent's current set.
+        # Agents are able to replace all application settings with those in this message.
+        #
+        # @return [Contrast::Agent::Reporting::Settings::ApplicationSettings, nil]
+        attr_accessor :application_settings
+
+        # All of the feature server_features
+        #
+        # @return [Contrast::Agent::Reporting::Settings::ServerFeatures, nil]
+        attr_accessor :server_features
+
+        # Success boolean message value
+        #
+        # @return [Boolean]
+        attr_accessor :success
+
+        # Message with reasons for success or fail.
+        #
+        # @return [Array<String>] Messages received from TS.
+        attr_accessor :messages
+
+        class << self
+          # All of the settings from TeamServer that apply at the application level.
+          #
+          # @return response [Contrast::Agent::Reporting::Response]
+          def build_application_response
+            res = new
+            res.application_settings = Contrast::Agent::Reporting::Settings::ApplicationSettings.new
+            res
+          end
+
+          # All of the settings from TeamServer that apply at the server level.
+          #
+          # @return response [Contrast::Agent::Reporting::Response]
+          def build_server_response
+            res = new
+            res.server_features = Contrast::Agent::Reporting::Settings::ServerFeatures.new
+            res
+          end
+        end
+
+        # Reaction the agent should take based on a state in TS.
+        # This is moved one level up because the responses we
+        # receive for feature and settings from TS have different
+        # place to store these reactions:
+        #
+        # body.reactions vs body.settings.reactions
+        #
+        # @return [Array<Contrast::Agent::Reporting::Settings::Reaction>]
+        def reactions
+          @_reactions ||= []
+        end
+
+        # Set the reaction
+        #
+        # @param reaction_array [Array<Reaction>] {
+        #   level     [String] The level at which the agent should log this reaction.
+        #                      [ERROR, WARN, INFO, DEBUG, TRACE]
+        #   message   [String] A message to log when receiving this reaction.
+        #   operation [String] What to do in response to this reaction.[NOOP, DISABLE] }
+        # @return [Array<Contrast::Agent::Reporting::Settings::Reaction>]
+        def reactions= reaction_array
+          return unless reaction_array.is_a?(Array)
+
+          reaction_array.each do |r|
+            reactions << Contrast::Agent::Reporting::Settings::Reaction.new(r[:level], r[:operation], r[:message])
+          end
+        end
+
+        # This method is used only for testing with golden files.
+        def to_controlled_hash
+          {
+              success: success,
+              messages: messages,
+              features: server_features.nil? ? nil : server_features.to_controlled_hash,
+              settings: application_settings.nil? ? nil : application_settings.to_controlled_hash,
+              logLevel: server_features&.log_level,
+              logFile: server_features&.log_file,
+              reactions: server_features.nil? ? nil : reactions.map(&:to_controlled_hash)
+          }.compact
+        end
+      end
+    end
+  end
+end