contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb

@@ -0,0 +1,149 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/assess_rule'
+require 'contrast/agent/reporting/settings/protect_rule'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the methods for TS response conversion to settings objects.
+      module ResponseExtractor
+        private
+
+        ##########################################
+        #         Server Settings Parsing        #
+        ##########################################
+
+        # This method is universal and used for both ng endpoing of feature settings and the new
+        # Server settings endpoint. Used in both build_feature_settings and build_server_settings.
+        # Passing the ng_ flag determines the use of the endpoint and response used because some of
+        # the response fields are with different names or do not exist: [enabled vs enable]
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess_server_settings response_data, res
+          assess = response_data[:assess]
+          return unless assess
+
+          res.server_features.assess.enabled = assess[:enable]
+          res.server_features.assess.report_stacktraces = assess[:report_stacktraces]
+          res.server_features.assess.sampling = assess[:sampling]
+          res.server_features.assess.sanitizers = assess[:sanitizers]
+          res.server_features.assess.validators = assess[:validators]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_server_settings response_data, res
+          protect = response_data[:protect]
+          return unless protect
+
+          res.server_features.protect.enabled = protect[:enable]
+          res.server_features.protect.observability = protect[:observability]
+          res.server_features.protect.log_enhancers = protect[:log_enhancers]
+          update_protect_rules(protect, res)
+        end
+
+        # This method is used with ServerSettings as we expect to have data for
+        # all the loggers - security_logger, logger, syslog.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_loggers response_data, res
+          logger = response_data[:logger]
+          security_logger = response_data[:security_logger]
+
+          if logger
+            res.server_features.log_level = logger[:level]
+            res.server_features.log_file = logger[:path]
+          end
+          return unless security_logger
+
+          log_level = security_logger[:level]
+          log_file = security_logger[:path]
+          res.server_features.security_logger.log_level = log_level
+          res.server_features.security_logger.log_file = log_file
+          res.server_features.security_logger.not_blank!
+          res.server_features.security_logger.syslog.assign_array(response_data[:security_logger][:syslog], ng_: false)
+        end
+
+        # @param protect [Hash] response data
+        # @param res [Contrast::Agent::Reporting::Response]
+        def update_protect_rules protect, res
+          return unless (rules = protect[:rules])
+
+          res.server_features.protect.ip_allowlist = rules[:ip_allowlist]
+          res.server_features.protect.ip_denylist = rules[:ip_denylist]
+          res.server_features.protect.bot_blocker.enable = rules[:bot_blocker][:enable]
+          res.server_features.protect.bot_blocker.bots = rules[:bot_blocker][:bots]
+          res.server_features.protect.rules_to_definition_list(rules)
+        end
+
+        ##########################################
+        #      Application Settings Parsing      #
+        ##########################################
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess_application_settings response_data, res
+          assess = response_data[:assess]
+          return unless assess
+
+          assess.each_pair do |rule_id, value|
+            rule_setting =
+              Contrast::Agent::Reporting::Settings::AssessRule.new.tap { |setting| setting.enable = value[:enable] }
+            res.application_settings.assess.rule_settings[rule_id.to_s] = rule_setting
+          end
+
+          # This endpoint can never give us session_id, so we dont need to set it here
+          # res.application_settings.assess.session_id
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_application_settings response_data, res
+          protect = response_data[:protect]
+          return unless protect
+
+          rules = protect[:rules]
+          rules&.each_pair do |rule_id, value|
+            rule_setting =
+              Contrast::Agent::Reporting::Settings::ProtectRule.new.tap { |setting| setting.mode = value[:mode] }
+            res.application_settings.protect.rule_settings[rule_id.to_s] = rule_setting
+          end
+          protect[:'virtual-patches']&.each do |patch_json|
+            res.application_settings.protect.virtual_patches <<
+                Contrast::Agent::Reporting::Settings::VirtualPatch.new(patch_json)
+          end
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_exclusions response_data, res
+          exclusions = response_data[:exclusions]
+          return unless exclusions
+
+          res.application_settings.exclusions.url_exclusions = exclusions[:url]
+          res.application_settings.exclusions.input_exclusions = exclusions[:input]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_sensitive_data_policy response_data, res
+          return unless (sensitive_data = response_data[:sensitive_data_masking_policy])
+
+          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
+          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
+          res.application_settings.sensitive_data_masking.build_rules_form_settings(sensitive_data[:rules])
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_reactions response_data, res
+          res.reactions = response_data[:reactions]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_utilities/response'
+require 'contrast/agent/reporting/reporting_utilities/response_handler_utils'
+require 'contrast/agent/reporting/reporting_utilities/response_handler_mode'
+require 'contrast/components/logger'
+require 'json'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will facilitate the Response capture and analysis functionality.
+      class ResponseHandler
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Agent::Reporting::ResponseHandlerUtils
+
+        # 15 min
+        TIMEOUT = 900.cs__freeze
+
+        # Process the response from TS
+        #
+        # @param response [Net::HTTP::Response, nil]
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event sent to TeamServer.
+        # @return response [Net::HTTP::Response, nil]
+        def process response, event
+          logger.debug('[Reporter] Received a response')
+          return unless analyze_response?(response)
+
+          # Handle the response body and obtain server_features or app_settings
+          report_response = convert_response(response, event)
+          return unless report_response
+
+          # Update Server Features and Application Settings to provide current agent settings
+          update_agent_settings(report_response)
+          # Process any reactions, including message logging and shutting down
+          update_reaction(report_response)
+          update_ruleset(report_response)
+          logger.trace('Agent settings updated in response to TeamServer', protect_on: ::Contrast::PROTECT.enabled?,
+                                                                           assess_on: ::Contrast::ASSESS.enabled?)
+          response
+        rescue StandardError => e
+          logger.error('Unable to process response from TeamServer', e)
+          nil
+        end
+
+        # If sleep is true puts reporting service to sleep.
+        def sleep?
+          @_sleep = wake_up if @_sleep.nil?
+          @_sleep
+        end
+
+        # For how long the agent should wait until retry
+        # to send message
+        #
+        # @return timeout [Integer] the time for reporter
+        # to be suspended.
+        def timeout
+          @_timeout ||= TIMEOUT
+        end
+
+        def mode
+          @_mode ||= Contrast::Agent::Reporting::ResponseHandlerMode.new
+        end
+
+        # Wakes the reporting service
+        def wake_up
+          @_sleep = false
+        end
+
+        private
+
+        # Handles the errors code received from TS and takes appropriate action.
+        # If we are here the response.code is an error that needs handling [4XX]
+        #
+        # @param response [Net::HTTP::Response]
+        def handle_error response
+          case response&.code
+          when ERROR_CODES[:message_not_sent]
+            handle_response_errors(response, UNSUCCESSFULLY_RECEIVED_MSG, mode.running)
+          when ERROR_CODES[:access_forbidden]
+            handle_response_errors(response, FORBIDDEN_MSG, mode.running)
+          when ERROR_CODES[:access_forbidden_no_action]
+            handle_response_errors(response, FORBIDDEN_NO_ACTION_MSG, mode.running)
+          when ERROR_CODES[:application_do_not_exist]
+            handle_response_errors(response, APP_NON_EXISTENT_MSG, mode.disabled)
+          when ERROR_CODES[:unprocessable_entity]
+            handle_response_errors(response, UNPROCESSABLE_ENTITY_MSG, mode.disabled)
+          when ERROR_CODES[:too_many_requests]
+            handle_response_errors(response, RETRY_AFTER_MSG, mode.resending)
+          else
+            logger.error('Unable to execute agent post_call')
+          end
+        end
+
+        # Suspend the reporter and try again in time. If not set
+        # the timeout is set to 15 min As default:
+        #
+        # @param message [String] Message to log.
+        # @param timeout [Integer,nil] The timeout to wait and retry after.
+        # @param error_message [String, nil] Error message if any received.
+        def suspend_reporting message, timeout, error_message
+          @_timeout = timeout || Contrast::Agent::Reporting::ResponseHandler::TIMEOUT
+          log_error_msg(message, timeout: @_timeout, error_message: error_message || 'none')
+          @_sleep = true
+        end
+
+        # Log what we've received.
+        #
+        # @param message [String] Message to log
+        # @param info_hash [Hash] information about the context to log.
+        def log_error_msg message, info_hash
+          logger.error(message, info_hash)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_mode.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the mode state in which the reporter will send
+      # event ot TS.
+      class ResponseHandlerMode
+        # Reader for the running mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are running
+        # and responses are being processed.
+        attr_reader :running
+        # Reader for the disabled mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are disabled
+        # due to received Error. The Reporting is disabled for this application.
+        attr_reader :disabled
+        # Reader for the resending/retry mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are suspended
+        # for a TS received amount of time and will try to resend the previous
+        # request after that.
+        attr_reader :resending
+        # Reader for all supported modes.
+        #
+        # @return [Array<Symbol>] Reporter's client and Response Handler all
+        # available modes of operation.
+        attr_reader :modes
+
+        def initialize
+          @running = :running
+          @disabled = :disabled
+          @resending = :resending
+          @modes = [@running, @disabled, @resending].cs__freeze
+        end
+
+        # Current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status
+          @_status ||= running
+        end
+
+        # Set current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status= mode
+          @_status = mode if mode.cs__is_a?(Symbol) && modes.include?(mode)
+        end
+
+        # Reset mode
+        #
+        def reset_mode
+          @_status = running
+        end
+      end
+    end
+  end
+end