contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/settings/sanitizer.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # The sanitizers defined by the user for use by the agent on this server for this organization.
+        class Sanitizer
+          ATTRIBUTES = %i[uuid api tags rules].cs__freeze
+
+          # @return uuid [String]
+          attr_accessor :uuid
+          # @return api [String]
+          attr_accessor :api
+          # @return uuid [Array<String>]
+          attr_accessor :tags
+          # @return uuid [Array<String>]
+          attr_accessor :rules
+
+          def initialize
+            @tags = []
+            @rules = []
+          end
+
+          def to_controlled_hash
+            {
+                api: api,
+                rules: rules,
+                tags: tags,
+                uuid: uuid
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/security_logger.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/syslog'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # this class will hold the security logger settings.
+        class SecurityLogger
+          def initialize
+            @blank = true
+          end
+
+          # check to see if object is being used
+          #
+          # @return [Boolean]
+          def settings_blank?
+            @blank
+          end
+
+          # Set the state of settings
+          #
+          # @return [Boolean]
+          def not_blank!
+            @blank = false
+          end
+
+          # The level at which the agent should log. Overridden by agent.logger.level
+          # if set in a local configuration
+          #
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level
+            @_log_level ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # set the log level
+          #
+          # @param log_level [String]
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level= log_level
+            @_log_level = log_level if log_level.is_a?(String)
+          end
+
+          # Where to log the agent's log file, if set by the user. Overridden by agent.logger.path
+          # if set in a local configuration.
+          #
+          # @return log_file [String] path
+          def log_file
+            @_log_file ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the log file
+          #
+          # @param log_file [String] path
+          # @return log_file [String] path
+          def log_file= log_file
+            @_log_file = log_file if log_file.is_a?(String)
+          end
+
+          def syslog
+            @_syslog ||= Contrast::Agent::Reporting::Settings::Syslog.new
+          end
+
+          def to_controlled_hash
+            {
+                level: log_level,
+                path: log_file,
+                syslog: syslog.to_controlled_hash
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/sensitive_data_masking.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/sensitive_data_masking_rule'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # Protect level settings for the sensitive_data_masking_policy.
+        # Configuration of the masking parameters will be delivered dynamically from TeamServer
+        # during an ApplicationSettings response from requests to TS endpoints that return that
+        # structure.
+        # https://contrast.atlassian.net/wiki/spaces/~699189087/pages/807960614/Sensitive+Data+Masking+Design
+        class SensitiveDataMasking
+          # Policy flag to enable the use of masking on request body
+          # Here is set to defaults to true.
+          #
+          # @return true | false
+          def mask_http_body?
+            @_mask_http_body
+          end
+
+          # Set the flag for request body masking
+          #
+          # @param bool [Boolean]
+          # @return true | false
+          def mask_http_body= bool
+            @_mask_http_body = bool.nil? ? true : !!bool
+          end
+
+          # Policy flag to enable the use of masking on attack vector.
+          # Here is set to defaults to false.
+          #
+          # @return true | false
+          def mask_attack_vector?
+            @_mask_attack_vector
+          end
+
+          # Set the flag for using masking on attack vector
+          #
+          # @param bool [Boolean]
+          # @return true | false
+          def mask_attack_vector= bool
+            @_mask_attack_vector = !!bool
+          end
+
+          # Rules to follow when using the masking
+          #
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, []]
+          def rules
+            @_rules ||= Contrast::Agent::Reporting::Settings::RulesArray.new
+          end
+
+          # Assign rules array
+          #
+          # @param rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>]
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, []]
+          def rules= rules
+            @_rules = rules if rules_array?(rules)
+          end
+
+          # Build rules from hash
+          #
+          # @param settings_rules [Array<Hash>] Response settings under Settings/sensitive_data_masking_policy/rules
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, nil
+          def build_rules_form_settings settings_rules
+            return if settings_rules.nil? || settings_rules.empty?
+
+            settings_rules.each do |rule|
+              instance = Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule.new
+              instance.rule_id = rule[:id]
+              instance.keywords = rule[:keywords]
+              rules << instance
+            end
+            rules
+          end
+
+          def to_controlled_hash
+            {
+                rules: rules.map(&:to_controlled_hash),
+                mask_attack_vector: mask_attack_vector?,
+                mask_http_body: mask_http_body?
+            }
+          end
+
+          private
+
+          # Determine if parameter is array of Rules.
+          #
+          # @param array [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>] Array of keywords.
+          # @return true | false
+          def rules_array? array
+            return false unless array.is_a?(Array)
+
+            array.all?(Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule)
+          end
+        end
+
+        # Simple validation class for Rules Array.
+        class RulesArray < Array
+          # Do not push anything except Rules instances.
+          # :<< method is called on object directly so this
+          # will make sure the data pushed is as expected.
+          #
+          # @param item [Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule]
+          # @return itself [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>]
+          def << item
+            return itself unless item.instance_of?(Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule)
+
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/sensitive_data_masking_rule.rb

@@ -0,0 +1,65 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # Protect level settings for the sensitive_data_masking_policy Rule entry.
+        class SensitiveDataMaskingRule
+          # Id for this rule.
+          #
+          # @return rule_id [String] Name of parameter to mask.
+          def rule_id
+            @_rule_id ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the rule name.
+          #
+          # @param id [String] Name of parameter to mask.
+          # @return rule_id [String]
+          def rule_id= id
+            @_rule_id = id.to_s
+          end
+
+          # Array of keywords to mask values for the rule_id.
+          #
+          # @return keywords [Array<String>] set of keywords
+          def keywords
+            @_keywords ||= []
+          end
+
+          # Set keywords array.
+          #
+          # @param words_array [Array<String>]
+          # @return keywords [Array<String>] set of keywords
+          def keywords= words_array
+            @_keywords = words_array if string_array?(words_array)
+          end
+
+          def to_controlled_hash
+            {
+                id: rule_id,
+                keywords: keywords
+            }
+          end
+
+          private
+
+          # Determine if a array is array of strings.
+          #
+          # @param array [Array<String] Array of keywords.
+          # @return true | false
+          def string_array? array
+            return false unless array.is_a?(Array) && array.any?
+
+            array.all?(String)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/server_features.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/settings/assess_server_feature'
+require 'contrast/agent/reporting/settings/protect_server_feature'
+require 'contrast/agent/reporting/settings/security_logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # All of the settings from TeamServer that apply at the server level.
+        # At least one, but not necessarily all, setting will differ from the agent's current set.
+        # agents are able to replace all server settings with those in this message.
+        class ServerFeatures
+          # The level at which the agent should log. Overridden by agent.logger.level
+          # if set in a local configuration
+          #
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level
+            @_log_level ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # set the log level
+          #
+          # @param log_level [String]
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level= log_level
+            @_log_level = log_level if log_level.is_a?(String)
+          end
+
+          # Where to log the agent's log file, if set by the user. Overridden by agent.logger.path
+          # if set in a local configuration.
+          #
+          # @return log_file [String] path
+          def log_file
+            @_log_file ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the log file
+          #
+          # @param log_file [String] path
+          # @return log_file [String] path
+          def log_file= log_file
+            @_log_file = log_file if log_file.is_a?(String)
+          end
+
+          # Class holding security logger settings:
+          #
+          # @return [Contrast::Agent::Reporting::Settings::SecurityLogger]
+          def security_logger
+            @_security_logger ||= Contrast::Agent::Reporting::Settings::SecurityLogger.new
+          end
+
+          # Controls for the reporting of telemetry events from the agent to TeamServer.
+          # This is NOT for the agent telemetry feature collecting metrics sent to other services.
+          #
+          # @return telemetry [Boolean]
+          def telemetry
+            @_telemetry
+          end
+
+          # sets the telemetry value
+          #
+          # @param telemetry [Boolean]
+          # @return telemetry [Boolean]
+          def telemetry= telemetry
+            @_telemetry = telemetry if !!telemetry == telemetry
+          end
+
+          # @return assess [Contrast::Agent::Reporting::Settings::AssessServerFeature]
+          def assess
+            @_assess ||= Contrast::Agent::Reporting::Settings::AssessServerFeature.new
+          end
+
+          # @return protect [Contrast::Agent::Reporting::Settings::ProtectServerFeature]
+          def protect
+            @_protect ||= Contrast::Agent::Reporting::Settings::ProtectServerFeature.new
+          end
+
+          def to_controlled_hash
+            {
+                security_logger: security_logger.settings_blank? ? nil : security_logger.to_controlled_hash,
+                assessment: @_assess ? assess.to_controlled_hash : {},
+                defend: @_protect ? protect.to_controlled_hash : {},
+                telemetry: telemetry
+            }.compact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/syslog.rb

@@ -0,0 +1,205 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # Controls for the syslogging feature in the agent
+        class Syslog
+          CONNECTION_TYPE = %w[UNENCRYPTED ENCRYPTED].cs__freeze
+          # Used for:
+          # severity_blocked, severity_blocked_perimeter, severity_exploited, severity_probed,
+          # severity_probed_perimeter
+          SEVERITIES = %w[ALERT CRITICAL ERROR WARNING NOTICE INFO DEBUG].cs__freeze
+          # Order and elements matter, the same setter must be called against same response field.
+          SYSLOG_METHODS_NG = %i[
+            enable= ip= port= facility= protocol= connection_type= severity_exploited= severity_blocked=
+            severity_probed= severity_probed_suspicious= severity_blocked_perimeter= severity_probed_perimeter=
+          ].cs__freeze
+          SYSLOG_RESPONSE_KEYS_NG = %i[
+            syslogEnabled syslogIpAddress syslogPortNumber syslogFacilityCode syslogProtocol
+            syslogConnectionType syslogSeverityExploited syslogSeverityBlocked syslogSeverityProbed
+            syslogSeveritySuspicious syslogSeverityBlockedPerimeter syslogSeverityProbedPerimeter
+          ].cs__freeze
+          SYSLOG_METHODS = %i[
+            enable= ip= port= facility= connection_type= severity_blocked= severity_blocked_perimeter=
+            severity_exploited= severity_probed= severity_probed_perimeter=
+          ].cs__freeze
+          SYSLOG_RESPONSE_KEYS = %i[
+            enable ip facility connection_type severity_blocked severity_blocked_perimeter severity_exploited
+            severity_probed severity_probed_perimeter
+          ].cs__freeze
+
+          # @return enable [Boolean]
+          attr_accessor :enable
+          # @return ip [Integer]
+          attr_accessor :ip
+          # @return port [Integer]
+          attr_accessor :port
+          # @return facility [Integer]
+          attr_accessor :facility
+          # @return protocol [String]
+          attr_accessor :protocol
+
+          def initialize
+            @enable = false
+            @ip = Contrast::Utils::ObjectShare::EMPTY_STRING
+            @port = 0
+            @facility = 0
+            @blank = true
+          end
+
+          # check to see if object is being used
+          #
+          # @return [Boolean]
+          def settings_blank?
+            @blank
+          end
+
+          # Set the state of settings
+          #
+          # @return [Boolean]
+          def not_blank!
+            @blank = false
+          end
+
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def connection_type
+            @_connection_type ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the connection type
+          #
+          # @param type [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def connection_type= type
+            @_connection_type = type if valid_entry?(type, CONNECTION_TYPE)
+          end
+
+          # @return severity_blocked [String]
+          def severity_blocked
+            @_severity_blocked ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_blocked= severity
+            @_severity_blocked = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_blocked_perimeter
+            @_severity_blocked_perimeter ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_blocked_perimeter= severity
+            @_severity_blocked_perimeter = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_exploited
+            @_severity_exploited ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_exploited= severity
+            @_severity_exploited = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed
+            @_severity_probed ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed= severity
+            @_severity_probed = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed_perimeter
+            @_severity_probed_perimeter ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed_perimeter= severity
+            @_severity_probed_perimeter = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed_suspicious
+            @_severity_probed_suspicious ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed_suspicious= severity
+            @_severity_probed_suspicious = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @param settings_array [Array] Settings retrieved from response
+          # @param ng_ [Boolean]
+          def assign_array settings_array, ng_: true
+            methods = ng_ ? SYSLOG_METHODS_NG : SYSLOG_METHODS
+            response_keys = ng_ ? SYSLOG_RESPONSE_KEYS_NG : SYSLOG_RESPONSE_KEYS
+
+            methods.each_with_index do |method, index|
+              send(method, settings_array[response_keys[index]])
+            end
+            not_blank!
+          end
+
+          def to_controlled_hash
+            {
+                syslogEnabled: enable,
+                syslogIpAddress: ip,
+                syslogPortNumber: port,
+                syslogFacilityCode: facility,
+                syslogConnectionType: connection_type,
+                syslogProtocol: protocol,
+                syslogSeverityExploited: severity_exploited,
+                syslogSeverityBlocked: severity_blocked,
+                syslogSeverityProbed: severity_probed,
+                syslogSeveritySuspicious: severity_probed_suspicious,
+                syslogSeverityBlockedPerimeter: severity_blocked_perimeter,
+                syslogSeverityProbedPerimeter: severity_probed_perimeter
+            }
+          end
+
+          private
+
+          # Gets String or Symbol value and assigns it to iv after
+          # validation with allowed types.
+          #
+          # @param value [String, Symbol] value to write
+          # @param validation_hash [Hash] to validate against
+          def valid_entry? value, validation_hash
+            return false unless value && validation_hash
+
+            validation_hash.include?(value)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/url_exclusion.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/exclusion_base'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # UrlExclusions class
+        class UrlExclusion < ExclusionBase
+          ATTRIBUTES = BASE_ATTRIBUTES.dup.cs__freeze
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/validator.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/sanitizer'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # The validators defined by the user for use by the agent on this server for this organization.
+        class Validator < Sanitizer
+          # This uses the same fields as Sanitizer.
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/virtual_patch.rb

@@ -0,0 +1,56 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/settings/virtual_patch_condition'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # The settings for each virtual patch in the agent.
+        class VirtualPatch
+          # @return [String]
+          attr_reader :name
+          # @return [String]
+          attr_reader :key
+          # @return [String]
+          attr_reader :uuid
+
+          def initialize hash
+            @name = hash[:name]
+            @key = hash[:key]
+            @uuid = hash[:uuid]
+
+            hash[:headers]&.each do |header_json|
+              headers << Contrast::Agent::Reporting::Settings::VirtualPatchCondition.new(header_json)
+            end
+
+            hash[:parameters]&.each do |header_json|
+              parameters << Contrast::Agent::Reporting::Settings::VirtualPatchCondition.new(header_json)
+            end
+
+            hash[:urls]&.each do |header_json|
+              urls << Contrast::Agent::Reporting::Settings::VirtualPatchCondition.new(header_json)
+            end
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def headers
+            @_headers ||= []
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def parameters
+            @_parameters ||= []
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def urls
+            @_urls ||= []
+          end
+        end
+      end
+    end
+  end
+end