contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/settings/virtual_patch_condition.rb

@@ -0,0 +1,47 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/settings/protect_rule'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # The settings for each virtual patch condition in the agent.
+        class VirtualPatchCondition
+          # @return [String]
+          attr_reader :name
+          # @return [String]
+          attr_reader :value
+          # @return [String]
+          attr_reader :input_type
+          # @return [String]
+          attr_reader :evaluation
+
+          def initialize hash
+            @name = hash[:name]
+            @value = hash[:value]
+            @input_type = hash[:input_type]
+            @evaluation = hash[:evaluation]
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def headers
+            @_headers ||= []
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def parameters
+            @_parameters ||= []
+          end
+
+          # @return [Array<Contrast::Agent::Reporting::Settings::VirtualPatchCondition>]
+          def urls
+            @_urls ||= []
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/request/request.rb

@@ -0,0 +1,189 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'resolv'
+require 'timeout'
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/request_utils'
+
+module Contrast
+  module Agent
+    # This class is the Contrast representation of the Rack::Request object. It
+    # provides access to the original Rack::Request object as well as extracts
+    # data in a format that the Agent expects, caching those transformations in
+    # order to avoid repeatedly creating Strings & thrashing GC.
+    class Request
+      include Contrast::Utils::RequestUtils
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
+
+      extend Forwardable
+
+      INNER_REST_TOKEN = %r{/\d+/}.cs__freeze
+      LAST_REST_TOKEN = %r{/\d+$}.cs__freeze
+      INNER_NUMBER_MARKER = '/{n}/'
+      LAST_NUMBER_MARKER = '/{n}'
+      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
+      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
+
+      # @return [Rack::Request] The passed to the Agent RackRequest to be wrapped.
+      attr_reader :rack_request
+      # @return [Contrast::Agent::Reporting::ObservedRoute] the route, used for coverage, of this request
+      attr_accessor :observed_route
+      # @return [Contrast::Agent::Reporting::RouteDiscovery]
+      attr_accessor :discovered_route
+
+      # Delegate calls to the following methods to the attribute @rack_request
+      def_delegators :@rack_request, :base_url, :cookies, :env, :ip, :media_type, :path, :port, :query_string,
+                     :request_method, :scheme, :url, :user_agent
+
+      # Initialize new Contrast Request
+      #
+      # @param rack_request [Rack::Request] The passed to the Agent RackRequest to be wrapped.
+      def initialize rack_request
+        @rack_request = rack_request
+      end
+
+      # The HTTP version of this request
+      # @return [String]
+      def version
+        env = rack_request.env
+        return '1.1' unless env
+
+        version = env['HTTP_VERSION']
+        return '1.1' unless version
+
+        version.split('/')[-1]
+      end
+
+      # Returns a normalized form of the URI. In "normal" URIs
+      # this will return an unchanged String, but in REST-y
+      # URIs this will normalize the digit path tokens, e.g.:
+      #
+      # /accounts/5/view
+      # ...becomes:
+      # /accounts/{n}/view
+      #
+      # Should also handle the ;jsessionid.
+      #
+      # @return uri [String]
+      def normalized_uri
+        @_normalized_uri ||= begin
+          path = rack_request.path_info || rack_request.path.to_s
+          path = '/' if path.empty?
+
+          uri = path.split(Contrast::Utils::ObjectShare::SEMICOLON)[0]    # remove ;jsessionid
+          uri = uri.split(Contrast::Utils::ObjectShare::QUESTION_MARK)[0] # remove ?query_string=
+          uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER)                 # replace interior tokens
+          uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER)                   # replace last token
+        end
+      end
+
+      # Returns the request file type
+      #
+      # @return type [Symbol<:XML, :JSON, :NORMAL>]
+      def document_type
+        @_document_type ||= if /xml/i.match?(media_type) || body&.start_with?('<?xml')
+                              :XML
+                            elsif /json/i.match?(media_type) || body&.match?(/\s*[{\[]/)
+                              :JSON
+                            else
+                              :NORMAL
+                            end
+      end
+
+      # Header keys upcased and any underscores replaced with dashes
+      #
+      # @return headers [Hash]
+      def headers
+        @_headers ||= with_contrast_scope do
+          hash = {}
+          env.each do |key, value|
+            next unless key
+
+            name = key.to_s
+            next unless name.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
+
+            hash[Contrast::Utils::StringUtils.normalized_key(name)] = value
+          end
+          hash
+        end
+      end
+
+      # Try and read the body and return memorized object of the body.
+      # If body contains file, do not parse it, otherwiseBody might be nil
+      #
+      # @return @_body [String, nil] The body of the Rack::Request
+      def body
+        # Memoize a flag indicating whether we've tried to read the body or not
+        # (can't use body because it might be nil)
+        @_body_read ||= begin
+          body = rack_request.body
+          if defined?(Rack::Multipart) &&
+                defined?(Rack::Multipart::UploadedFile) &&
+                body.is_a?(Rack::Multipart::UploadedFile)
+
+            logger.trace('not parsing uploaded file body',
+                         file_name: body.original_filename,
+                         content_type: body.content_type)
+            @_body = nil
+          else
+            logger.trace('parsing body from request', body_type: body.cs__class.cs__name)
+            @_body = Contrast::Utils::StringUtils.force_utf8(read_body(body))
+          end
+
+          true
+        end
+
+        # Return memoized body (which might be nil)
+        @_body
+      end
+
+      # flattened hash of request params
+      #
+      # @return parameters [Hash]
+      def parameters
+        @_parameters ||= with_contrast_scope { normalize_params(rack_request.params) }
+      end
+
+      # returns multipart filenames
+      #
+      # @return file_names [Hash]
+      def file_names
+        @_file_names ||= begin
+          names = {}
+          parsed_data = Rack::Multipart.parse_multipart(rack_request.env)
+          traverse_parsed_multipart(parsed_data, names)
+        rescue StandardError => _e
+          logger.warn('Unable to parse multipart request!')
+          {}
+        end
+      end
+
+      # returns or fenerates the hash checksum for the request
+      #
+      # @return @_hash_id [String] Contrast::Utils::HashDigest generated string checksum
+      def hash_id
+        @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
+      end
+
+      # Utility method for checking if a request is for a static resource.
+      # @return [Boolean] true, if the request is for a well-known static
+      #  type as determined by the request suffix or the accept header.
+      def static?
+        return true if normalized_uri&.match?(STATIC_SUFFIXES)
+
+        accepts = Array(headers['ACCEPT'])&.first&.to_s
+        return false unless accepts
+        return false if accepts.start_with?('*/*')
+
+        accepts.start_with?(*MEDIA_TYPE_MARKERS)
+      end
+    end
+  end
+end

data/lib/contrast/agent/request/request_context.rb

@@ -0,0 +1,143 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/timer'
+require 'contrast/agent/request/request'
+require 'contrast/agent/response/response'
+require 'contrast/agent/inventory/database_config'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/request_utils'
+require 'contrast/agent/request/request_context_extend'
+require 'contrast/agent/reporting/reporting_events/observed_route'
+require 'contrast/agent/reporting/input_analysis/input_analysis'
+require 'contrast/agent/reporting/reporting_events/application_activity'
+
+module Contrast
+  module Agent
+    # This class acts to encapsulate information about the currently executed request, making it available to the Agent
+    # for the duration of the request in a standardized and normalized format which the Agent understands.
+    class RequestContext
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
+      include Contrast::Utils::RequestUtils
+      include Contrast::Agent::RequestContextExtend
+
+      INPUT_ANALYSIS = Contrast::Agent::Reporting::InputAnalysis.new
+
+      # @return [Contrast::Agent::Reporting:ApplicationActivity] the application activity found in this request
+      attr_reader :activity
+      # @return [Hash] context used to log the request
+      attr_reader :logging_hash
+      # @return [Contrast::Agent::Reporting::ObservedRoute] the route, used for coverage, of this request
+      attr_reader :observed_route
+      # @return [Contrast::Agent::Request] our wrapper around the Rack::Request for this context
+      attr_reader :request
+      # @return [Contrast::Agent::Response] our wrapper around the Rack::Response or Array for this context,
+      #   only available after the application has finished its processing
+      attr_reader :response
+      # @return [Contrast::Agent::Reporting::RouteDiscovery] the route, used for findings, of this request
+      attr_reader :discovered_route
+      # @return [Contrast::Agent::Reporting::InputAnalysis]
+      attr_reader :agent_input_analysis
+      # @return [Array<String>] the hash of findings already reported fro this request
+      attr_reader :reported_findings
+      # @return [Contrast::Utils::Timer] when the context was created
+      attr_reader :timer
+
+      attr_accessor :propagation_event_count, :source_event_count
+
+      def initialize rack_request, app_loaded: true
+        with_contrast_scope do
+          # all requests get a timer and hash
+          @timer = Contrast::Utils::Timer.new
+          @logging_hash = { request_id: __id__ }
+
+          # instantiate helper for request and response
+          @request = Contrast::Agent::Request.new(rack_request) if rack_request
+          @activity = Contrast::Agent::Reporting::ApplicationActivity.new
+
+          # build analyzer
+          @do_not_track = false
+          @agent_input_analysis = INPUT_ANALYSIS
+          agent_input_analysis.request = request
+
+          # flag to indicate whether the app is fully loaded
+          @app_loaded = !!app_loaded
+
+          # generic holder for properties that can be set throughout this request
+          @_properties = {}
+
+          # count of propagation events
+          @propagation_event_count = 0
+
+          # count of source events
+          @source_event_count = 0
+
+          if ::Contrast::ASSESS.enabled?
+            @sample_req, @sample_res = Contrast::Utils::Assess::SamplingUtil.instance.sample?(@request)
+          end
+
+          @reported_findings = []
+
+          handle_routes
+        end
+      end
+
+      def app_loaded?
+        @app_loaded
+      end
+
+      def analyze_request?
+        analyze_request_assess? || analyze_req_res_protect?
+      end
+
+      def analyze_response?
+        analyze_response_assess? || analyze_req_res_protect?
+      end
+
+      def analyze_req_res_protect?
+        ::Contrast::PROTECT.enabled?
+      end
+
+      def analyze_request_assess?
+        return false unless analyze_req_res_assess?
+
+        @sample_req
+      end
+
+      def analyze_response_assess?
+        return false unless analyze_req_res_assess?
+
+        @sample_res &&= ::Contrast::ASSESS.scan_response?
+      end
+
+      def analyze_req_res_assess?
+        ::Contrast::ASSESS.enabled?
+      end
+
+      def add_property key, value
+        @_properties[key] = value
+      end
+
+      def get_property key
+        @_properties[key]
+      end
+
+      def reset_activity
+        @activity = Contrast::Agent::Reporting::ApplicationActivity.new
+        @observed_route = Contrast::Agent::Reporting::ObservedRoute.new
+      end
+
+      private
+
+      def handle_routes
+        @observed_route = Contrast::Agent::Reporting::ObservedRoute.new
+        reporting_route = Contrast::Agent.framework_manager.get_route_information(@request)
+        append_to_observed_route(reporting_route)
+      rescue StandardError => e
+        logger.error('Unable to determine current route', e)
+      end
+    end
+  end
+end

data/lib/contrast/agent/request/request_context_extend.rb

@@ -0,0 +1,105 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/auto_complete_rule'
+require 'contrast/agent/assess/rule/response/cache_control_header_rule'
+require 'contrast/agent/assess/rule/response/click_jacking_header_rule'
+require 'contrast/agent/assess/rule/response/csp_header_insecure_rule'
+require 'contrast/agent/assess/rule/response/csp_header_missing_rule'
+require 'contrast/agent/assess/rule/response/hsts_header_rule'
+require 'contrast/agent/assess/rule/response/parameters_pollution_rule'
+require 'contrast/agent/assess/rule/response/x_content_type_header_rule'
+require 'contrast/agent/assess/rule/response/x_xss_protection_header_rule'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/components/logger'
+require 'contrast/utils/log_utils'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    # This class extends RequestContexts: this class acts to encapsulate information about the currently
+    # executed request, making it available to the Agent for the duration of the request in a standardized
+    # and normalized format which the Agent understands.
+    module RequestContextExtend
+      include Contrast::Utils::CEFLogUtils
+      include Contrast::Components::Logger::InstanceMethods
+      # Convert the discovered route for this request to appropriate forms and disseminate it to those locations
+      # where it is necessary for our route coverage and finding vulnerability discovery features to function.
+      #
+      # @param route [Contrast::Agent::Reporting::RouteCoverage]
+      def append_to_observed_route route
+        return unless route
+
+        @observed_route.signature  = route.route
+        @observed_route.verb       = route.verb
+        @observed_route.url        = route.url if route.url
+        @request.observed_route    = @observed_route
+
+        observation = Contrast::Agent::Reporting::RouteDiscoveryObservation.new(route.url, route.verb)
+        @discovered_route = Contrast::Agent::Reporting::RouteDiscovery.new(route.route, observation)
+        @request.discovered_route = @discovered_route
+      end
+
+      # If protect is enabled for this request, examine said request for any possible attack input. If those inputs
+      # provided match a rule which should block at the perimeter, that will be raised here.
+      #
+      # @raise [Contrast::SecurityException]
+      def protect_input_analysis
+        return false unless ::Contrast::AGENT.enabled?
+        return false unless ::Contrast::PROTECT.enabled?
+        return false if @do_not_track
+
+        if (ia = Contrast::Agent::Protect::InputAnalyzer.analyse(request))
+          # Handle prefilter
+          Contrast::Agent::Protect::InputAnalyzer.input_classification(ia, prefilter: true)
+          # Reflected xss infilter
+          Contrast::Agent::Protect::InputAnalyzer.input_classification_for('reflected-xss', ia)
+          @agent_input_analysis = ia
+        else
+          logger.trace('Analysis from Agent was empty.')
+        end
+      rescue Contrast::SecurityException => e
+        raise(e)
+      rescue StandardError => e
+        logger.warn('Unable to extract protect information from request', e)
+      end
+
+      # Builds IA only for postfilter rules. If rules during infilter were not triggered there will be
+      # no IA for them later to use it in postfilter.
+      #
+      # @raise [Contrast::SecurityException]
+      def protect_postfilter_ia
+        return false unless ::Contrast::AGENT.enabled?
+        return false unless ::Contrast::PROTECT.enabled?
+
+        # Handle postfilter
+        Contrast::Agent::Protect::InputAnalyzer.input_classification(@agent_input_analysis, postfilter: true)
+      rescue Contrast::SecurityException => e
+        raise(e)
+      rescue StandardError => e
+        logger.warn('Unable to extract protect information from request - postfilter', e)
+      end
+
+      # append anything we've learned to the request seen message this is the sum-total of all inventory information
+      # that has been accumulated since the last request
+      def extract_after rack_response
+        # We must ALWAYS save the response, even if we don't need it here for response sampling. It is used for other
+        # vulnerability detection, most notably XSS, and not capturing it may suppress valid findings.
+        @response = Contrast::Agent::Response.new(rack_response)
+        return unless @sample_res
+
+        Contrast::Agent::Assess::Rule::Response::AutoComplete.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CacheControl.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::ClickJacking.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderMissing.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderInsecure.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::HSTSHeader.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::ParametersPollution.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XContentType.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XXssProtection.new.analyze(@response)
+      rescue StandardError => e
+        logger.error('Unable to extract information after request', e)
+      end
+    end
+  end
+end

data/lib/contrast/agent/request/request_handler.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporter'
+require 'contrast/agent/reporting/masker/masker'
+
+module Contrast
+  module Agent
+    # This class is instantiated when we receive a request and the agent is enabled to process that request. It holds
+    # the ruleset that we perform filtering operations on (currently prefilter and postfilter).
+    class RequestHandler
+      include Contrast::Components::Logger::InstanceMethods
+
+      attr_reader :ruleset, :context
+
+      # @param context [Contrast::Agent::RequestContext] the context of the request for which this handler applies
+      def initialize context
+        @context = context
+        @ruleset = ::Contrast::AGENT.ruleset
+      end
+
+      # reports events[Contrast::Agent::Reporting::ObservedRoute] to TS
+      # Other ReportingEvents are handled through batching in the middleware
+      #
+      def report_observed_route
+        return unless (reporter = Contrast::Agent.reporter)
+
+        reporter.send_event(context.observed_route) if Contrast::ROUTES_SENT.sendable?(context.observed_route)
+      end
+
+      # If the response is streaming, we should only perform filtering on our stream safe rules
+      def stream_safe_postfilter
+        stream_safe_ruleset = ruleset.select(&:stream_safe?)
+        postfilter_ruleset = Contrast::Agent::RuleSet.new(stream_safe_ruleset)
+        postfilter_ruleset.postfilter
+      end
+    end
+  end
+end

data/lib/contrast/agent/response/response.rb

@@ -0,0 +1,87 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'resolv'
+require 'timeout'
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/logger'
+require 'contrast/utils/response_utils'
+
+module Contrast
+  module Agent
+    # This class is the Contrast representation of the Rack::Response object. It
+    # provides access to the original Rack::Response object as well as extracts
+    # data in a format that the Agent expects, caching those transformations in
+    # order to avoid repeatedly creating Strings & thrashing GC.
+    class Response
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Utils::ResponseUtils
+
+      extend Forwardable
+
+      # @return [Array, Rack::Response] The Rack Response passed by the application & middleware. It can be an Array
+      #   in format [response_code, header_hash, response_body] or an instance of Rack::Response
+      attr_reader :rack_response
+
+      def initialize rack_response
+        @rack_response = rack_response
+        @is_array = !rack_response.is_a?(Rack::Response)
+      end
+
+      # The document type of the response, based on its Content-Type. Can be one of :JSON, :NORMAL, :XML, or nothing.
+      #
+      # @return [Symbol<:XML, :JSON, :NORMAL>, nil]
+      def document_type
+        case content_type
+        when /xml/i
+          :XML
+        when /json/i
+          :JSON
+        when /html/i
+          :NORMAL
+        end
+      end
+
+      # The response code of this response
+      #
+      # @return [Integer]
+      def response_code
+        return unless rack_response
+
+        @is_array ? rack_response[0].to_i : rack_response.status
+      end
+
+      # The headers of this response
+      #
+      # @return [Hash, nil]
+      def headers
+        return unless rack_response
+
+        @is_array ? rack_response[1] : rack_response.headers
+      end
+
+      # The Content-Type of this response, as set in the headers hash under the key Rack::CONTENT_TYPE
+      #
+      # @return [String, nil]
+      def content_type
+        return unless rack_response
+
+        @is_array ? headers[Rack::CONTENT_TYPE] : rack_response.content_type
+      end
+
+      # The response body can change during the request lifecycle, so we have to look it up every time we need it.
+      # We should not extract it out as a variable here, or we'll miss those changes.
+      #
+      # @return [String, nil]
+      def body
+        return unless rack_response
+
+        body_content = @is_array ? rack_response[2] : rack_response.body
+        extract_body(body_content)
+      end
+    end
+  end
+end