contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/components/logger.rb

@@ -1,92 +1,62 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/logger/log'
+require 'contrast/logger/cef_log'
+require 'contrast/components/base'
+
 module Contrast
   module Components
-    module Logger
-      module InstanceMethods #:nodoc:
+    module Logger # :nodoc:
+      module InstanceMethods # :nodoc:
         def logger
-          Contrast::Components::Logger::COMPONENT_INTERFACE
+          Contrast::Logger::Log.instance.logger
+        end
+
+        # When calling this method from any instance
+        # The CEF logger will be initialized and it's
+        # path and level will be set. Since we don't
+        # call this method unless protect is started,
+        # on Agent Startup no file is created before is
+        # needed.
+        #
+        # @return [Logger]
+        def cef_logger
+          @_cef_logger ||= Contrast::Logger::CEFLog.instance.tap(&:build_logger)
         end
       end
-      ClassMethods = InstanceMethods
 
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Agent Logger.
+      # So This class here follows the update for the configuration
+      # and from know on ( if it's as we planned it to be) it will hold the
+      # instance methods and will initialize new instances for where they're needed
       class Interface
+        include InstanceMethods
         include Contrast::Components::ComponentBase
 
-        %w[error? warn? info? debug?].each do |level|
-          define_method(level) { state.logger.send(level) }
-        end
-
-        # def trace? # TODO: RUBY-547
-        #  config&.agent&.logger&.level && config.agent.logger.level.to_s.casecmp('TRACE').to_i.zero?
-        # end
-
-        def error *args
-          log_with_level(*args, :error)
-        end
-
-        def warn *args
-          log_with_level(*args, :warn)
-        end
-
-        def info *args
-          log_with_level(*args, :info)
-        end
-
-        def debug *args
-          log_with_level(*args, :debug)
-        end
-
-        def with_level *args
-          log_with_level(*args)
-        end
-
-        def debug_with_time msg
-          ret = nil
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        # def trace_with_time msg # TODO: RUBY-547
-        #  ret = nil
-        #  unless trace?
-        #    ret = yield if block_given?
-        #    return ret
-        #  end
-        #
-        #  a = Contrast::Utils::Timer.now_ms
-        #  ret = yield if block_given?
-        #  z = Contrast::Utils::Timer.now_ms
-        #  log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-        #  ret
-        # end
-
-        private
-
-        def log_with_level *args
-          if args.length == 2
-            msg, level = *args
-            state.cs__class.log_with_level(nil, msg, level)
-          elsif args.length == 3
-            exception, msg, level = *args
-            state.cs__class.log_with_level(exception, msg, level)
-          end
-
-          nil
-        rescue StandardError
-          nil
+        CANON_NAME = 'agent.logger'
+        CONFIG_VALUES = %w[path level progname].cs__freeze
+
+        # @return [String, nil]
+        attr_accessor :path
+        # @return [String, nil]
+        attr_accessor :level
+        # @return [String, nil]
+        attr_accessor :progname
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @path = hsh[:path]
+          @level = hsh[:level]
+          @progname = hsh[:progname]
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/polling.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+
+module Contrast
+  module Components
+    module Polling
+      # A wrapper build around the agent.polling config
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        # @return [Integer, nil]
+        attr_accessor :server_settings_ms
+        # @return [Integer, nil]
+        attr_accessor :app_settings_ms
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+        # @return [Integer, nil]
+        attr_accessor :batch_reporting_interval_ms
+
+        CANON_NAME = 'agent.polling'
+        CONFIG_VALUES = %w[server_settings_ms app_settings_ms batch_reporting_interval_ms].cs__freeze
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @server_settings_ms = hsh[:server_settings_ms]
+          @batch_reporting_interval_ms = hsh[:batch_reporting_interval_ms]
+          @app_settings_ms = hsh[:app_settings_ms]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/protect.rb

@@ -1,38 +1,164 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+require 'contrast/config/exception_configuration'
+require 'contrast/config/protect_rule_configuration'
+
 module Contrast
   module Components
     module Protect
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Protect
-      # product.
+      # A wrapper build around the Common Agent Configuration project to allow for access of the values contained in
+      # its parent_configuration_spec.yaml.  Specifically, this allows for querying the state of the Protect product.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
+        include Contrast::Config::BaseConfiguration
 
-        access_component :settings
+        CANON_NAME = 'protect'
+        CONFIG_VALUES = %w[enabled?].cs__freeze
+        RULES = 'rules'
+        MODE = 'mode'
 
-        def enabled?
-          state.protect_enabled?
+        # @return [Boolean, nil]
+        attr_accessor :enable
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+        # @return [Boolean, nil]
+        attr_accessor :agent_lib
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @_exceptions = Contrast::Config::ExceptionConfiguration.new(hsh[:exceptions])
+          @_rules = Contrast::Config::ProtectRulesConfiguration.new(hsh[:rules])
+          @enable = hsh[:enable]
+          @agent_lib = hsh[:agent_lib]
         end
 
-        def forcibly_disabled?
-          state.protect_forcibly_disabled?
+        # @return [Contrast::Config::ExceptionConfiguration]
+        def exceptions
+          @_exceptions ||= Contrast::Config::ExceptionConfiguration.new
         end
 
+        # Name is kept the same - rules to correspond to config,
+        # mapping. - protect.rules
+        #
+        # @return [Contrast::Config::ProtectRulesConfiguration]
         def rules
-          SETTINGS.protect_rules
+          @_rules ||= Contrast::Config::ProtectRulesConfiguration.new
+        end
+
+        def rules= new_rules
+          @_rules = new_rules
+        end
+
+        def exceptions= new_exceptions
+          @_exceptions = new_exceptions
+        end
+
+        def enabled?
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
+
+          ::Contrast::SETTINGS.protect_state.enabled == true
+        end
+
+        # Current Configuration for the protect rules
+        #
+        # @return [Contrast::Config::ProtectRulesConfiguration]
+        def rule_config
+          ::Contrast::CONFIG.protect.rules
+        end
+
+        # Returns Protect array of all initialized
+        # protect rules.
+        #
+        # @return defend_rules[Hash<Contrast::SETTINGS.protect_state.rules>]
+        def defend_rules
+          ::Contrast::SETTINGS.protect_state.rules
+        end
+
+        # The Contrast::CONFIG.protect.rules is object so we need to check it's
+        # corresponding method call for each rule of interest. If there is no
+        # status available we search for any Settings available received form
+        # TS response.
+        #
+        # @param rule_id [String]
+        # @return mode [Symbol]
+        def rule_mode rule_id
+          str = rule_id.tr('-', '_')
+          ::Contrast::CONFIG.protect.rules[str]&.applicable_mode ||
+              ::Contrast::SETTINGS.application_state.modes_by_id[rule_id] ||
+              :NO_ACTION
         end
 
+        # Name of the protect rule
+        #
+        # @return [String]
         def rule name
-          SETTINGS.protect_rules[name]
+          ::Contrast::SETTINGS.protect_state.rules[name]
+        end
+
+        def report_any_command_execution?
+          if @_report_any_command_execution.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::CmdInjection::NAME]
+            @_report_any_command_execution = ctrl && true?(ctrl.disable_system_commands)
+          end
+          @_report_any_command_execution
+        end
+
+        def report_custom_code_sysfile_access?
+          if @_report_custom_code_sysfile_access.nil?
+            name_changed = Contrast::Agent::Protect::Rule::PathTraversal::NAME.tr('-', '_')
+            ctrl = rule_config[name_changed]
+            @_report_custom_code_sysfile_access = ctrl && true?(ctrl.detect_custom_code_accessing_system_files)
+          end
+          @_report_custom_code_sysfile_access
         end
-      end
 
-      COMPONENT_INTERFACE = Interface.new
+        def forcibly_disabled?
+          return @_forcibly_disabled unless @_forcibly_disabled.nil?
+
+          @_forcibly_disabled = false?(::Contrast::CONFIG.protect.enable)
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          super
+          protect_rules_to_effective_config(effective_config)
+        end
+
+        private
+
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def protect_rules_to_effective_config effective_config
+          return unless defend_rules
+
+          defend_rules.each do |key, value|
+            next unless key && value
+
+            config_prefix = "#{ CANON_NAME }.#{ RULES }.#{ key }"
+            name_prefix = "#{ CONTRAST }.#{ CANON_NAME }.#{ RULES }.#{ key }"
+            add_single_effective_value(effective_config, ENABLE, value.enabled?, config_prefix, name_prefix)
+            # Get the mode by checking Current Configs or Settings received:
+            add_single_effective_value(effective_config, MODE, rule_mode(key), config_prefix, name_prefix)
+          end
+        end
+
+        def forcibly_enabled?
+          return @_forcibly_enabled unless @_forcibly_enabled.nil?
+
+          @_forcibly_enabled ||= true?(::Contrast::CONFIG.protect.enable)
+        end
+      end
     end
   end
 end

data/lib/contrast/components/ruby_component.rb

@@ -0,0 +1,135 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+require 'contrast/components/scope'
+
+module Contrast
+  module Components
+    module Ruby
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its parent_configuration_spec.yaml.
+      # Those in this section pertain to the specific settings that apply to Ruby.
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        DISABLED_RAKE_TASK_LIST = %w[
+          about assets:clean assets:clobber assets:environment
+          assets:precompile assets:precompile:all db:create db:drop db:fixtures:load db:migrate
+          db:migrate:status db:rollback db:schema:cache:clear db:schema:cache:dump db:schema:dump
+          db:schema:load db:seed db:setup db:structure:dump db:version doc:app graphql:install graphql:object
+          log:clear middleware notes notes:custom rails:template rails:update routes secret spec spec:features
+          spec:requests spec:controllers spec:helpers spec:models spec:views spec:routing spec:rcov stats
+          test test:all test:all:db test:recent test:single test:uncommitted time:zones:all tmp:clear
+          tmp:create webpacker:compile
+        ].cs__freeze
+
+        DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
+        CANON_NAME = 'agent.ruby'
+        CONFIG_VALUES = %w[
+          disabled_agent_rake_tasks
+          propagate_yield require_scan
+          non_request_tracking
+          uninstrument_namespace
+          application_scope
+        ].cs__freeze
+
+        # Set a comma-separated string of rake tasks in which to disable agent operation.
+        #
+        # @return [Array]
+        attr_writer :disabled_agent_rake_tasks
+        # @return [ExceptionConfiguration]
+        attr_writer :exceptions
+        # Controls whether or not we patch the rb_yield block to track split propagation
+        #
+        # @return [Boolean]
+        attr_writer :propagate_yield
+        # Controls the scan of the given trace_point, built from an :end event, to determine
+        # where the loaded code lives and scanning that code for policy any violations.
+        # @return [Boolean]
+        attr_writer :require_scan
+        # Controls whether the agent should track outside request
+        #
+        # @return [Boolean]
+        attr_writer :non_request_tracking
+        # listed module names for skipping instrumentation.
+        #
+        # @return [Array]
+        attr_writer :uninstrument_namespace
+        # Controls if the agent should instrument only the application code
+        #
+        # @return[Boolean]
+        attr_accessor :application_scope
+
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @disabled_agent_rake_tasks = hsh[:disabled_agent_rake_tasks]
+          @exceptions = Contrast::Config::ExceptionConfiguration.new(hsh[:exceptions])
+          @propagate_yield = hsh[:propagate_yield]
+          @require_scan = hsh[:require_scan]
+          @non_request_tracking = hsh[:non_request_tracking]
+          @uninstrument_namespace = hsh[:uninstrument_namespace]
+          # This value must only be read form ENV. The cs__with_app_scope? method handles the
+          # validation of the set Application Scope Flag.
+          @application_scope = Contrast::Components::Scope.cs__with_app_scope? == 1
+        end
+
+        # These commands being detected will result the agent disabling instrumentation, generally any command
+        # that doesn't result in the application listening on a port can be added here, this normally includes tasks
+        # that are ran pre-startup(like migrations) or to show information about the application(such as routes)
+        # @return [Array, DISABLED_RAKE_TASK_LIST]
+        def disabled_agent_rake_tasks
+          @disabled_agent_rake_tasks.nil? ? DISABLED_RAKE_TASK_LIST : @disabled_agent_rake_tasks
+        end
+
+        # rubocop:disable Naming/MemoizedInstanceVariableName
+        # @return [Contrast::Config::ExceptionConfiguration]
+        def exceptions
+          @exceptions ||= Contrast::Config::ExceptionConfiguration.new
+        end
+        # rubocop:enable Naming/MemoizedInstanceVariableName
+
+        # controls whether or not we patch the rb_yield block to track split propagation
+        # @return [Boolean, Contrast::Utils::ObjectShare::TRUE]
+        def propagate_yield
+          @propagate_yield.nil? ? Contrast::Utils::ObjectShare::TRUE : @propagate_yield
+        end
+
+        # control whether or not we run file scanning rules on require
+        # @return [Boolean, Contrast::Utils::ObjectShare::TRUE]
+        def require_scan
+          @require_scan.nil? ?  Contrast::Utils::ObjectShare::TRUE  : @require_scan
+        end
+
+        # controls tracking outside of request
+        # @return [Boolean, Contrast::Utils::ObjectShare::FALSE]
+        def non_request_tracking
+          @non_request_tracking.nil? ? Contrast::Utils::ObjectShare::FALSE : @non_request_tracking
+        end
+
+        # @return [Array, DEFAULT_UNINSTRUMENTED_NAMESPACES]
+        def uninstrument_namespace
+          @uninstrument_namespace.nil? ? DEFAULT_UNINSTRUMENTED_NAMESPACES : @uninstrument_namespace
+        end
+
+        # Checks to see if we support with_app_scope for the current Agent Startup.
+        # Defaults to false if configuration is not set.
+        #
+        # @return [Boolean]
+        def start_with_application_scope?
+          return application_scope if application_scope
+
+          false
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/rule_set.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    # This class is responsible for holding our ruleset and performing filtering operations on all
+    # rules when asked by the middleware.
+    class RuleSet < Set
+      include Contrast::Components::Logger::InstanceMethods
+
+      # The filtering that needs to happen before the application gets access to the request object.
+      # The main action here is snapshotting the request as provided to the application from the
+      # user before any application code has acted upon it. Additionally, this is where Protect will
+      # terminate requests on attack detection if set to block at perimeter
+      #
+      # @raise [Contrast::SecurityException] raises error if security exception is thrown in prefilter
+      def prefilter
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context&.analyze_request?
+
+        logger.trace_with_time('Running prefilter...') do
+          map { |rule| rule.prefilter(context) }
+        end
+      rescue Contrast::SecurityException => e
+        logger.warn('RASP threw security exception in prefilter', e)
+        raise(e)
+      rescue StandardError => e
+        logger.error('Unexpected exception during prefilter', e)
+      end
+
+      # The filtering that needs occur after the application has acted on the request and the response
+      # has been created. The main actions here are analyzing the response for unsafe state or actions.
+      #
+      # @raise [Contrast::SecurityException] raises error if security exception is thrown in postfilter
+      def postfilter
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context&.analyze_response?
+
+        logger.trace_with_time('Running postfilter...') do
+          map { |rule| rule.postfilter(context) }
+        end
+      rescue Contrast::SecurityException => e
+        logger.warn('RASP threw security exception in postfilter', e)
+        raise(e)
+      rescue StandardError => e
+        logger.error('Unexpected exception during postfilter', e)
+      end
+    end
+  end
+end