contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/head_dump_utils_extend.rb

@@ -0,0 +1,74 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # this module extends HeadDumpUtil
+    module HeadDumpExtend
+      def log_enabled_warning
+        control = Contrast::Utils::HeapDumpUtil.control
+        dir    = control[:path]
+        window = control[:window]
+        count  = control[:count]
+        delay  = control[:delay]
+        clean  = control[:clean]
+
+        logger.info(<<~WARNING)
+          *****************************************************
+          ********      HEAP DUMP HAS BEEN ENABLED     ********
+          *** APPLICATION PROCESS WILL EXIT UPON COMPLETION ***
+          *****************************************************
+
+          Heap dump is a debugging tool that snapshots the entire
+          state of the Ruby VM. It is an exceptionally expensive
+          process, and should only be used to debug especially
+          pernicious errors.
+
+          It will write multiple memory snaphots, which are liable
+          to be multiple gigabytes in size.
+          They will be named "[unix timestamp]-heap.dump",
+          e.g.: 1020304050-heap.dump
+
+          It will then call Ruby `exit()`.
+
+          If this is not your specific intent, you can (and should)
+          disable this option in your Contrast config file.
+
+          HEAP DUMP PARAMETERS:
+          \t[write files to this directory]             dir:     #{ dir    }
+          \t[wait this many seconds in between dumps]   window:  #{ window }
+          \t[heap dump this many times]                 count:   #{ count  }
+          \t[wait this many seconds into app lifetime]  delay:   #{ delay  }
+          \t[perform gc pass before dump]               clean:   #{ clean  }
+
+          *****************************************************
+          ********        YOU HAVE BEEN WARNED         ********
+          *****************************************************
+        WARNING
+      end
+
+      def capture_heap_dump
+        control = Contrast::Utils::HeapDumpUtil.control
+        dir    = control[:path]
+        window = control[:window]
+        count  = control[:count]
+        clean  = control[:clean]
+        logger.info('HEAP DUMP MAIN LOOP')
+        ObjectSpace.trace_object_allocations_start
+        count.times do |i|
+          logger.info('STARTING HEAP DUMP PASS', current_pass: i, max: count)
+          snapshot_heap(dir, clean)
+          logger.info('FINISHING HEAP DUMP PASS', current_pass: i, max: count)
+          sleep(window)
+        end
+      ensure
+        ObjectSpace.trace_object_allocations_stop
+        logger.info('*****************************************************')
+        logger.info('********        HEAP DUMP HAS CONCLUDED      ********')
+        logger.info('***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
+        logger.info('*****************************************************')
+        exit # rubocop:disable Rails/Exit We weren't kidding!
+      end
+    end
+  end
+end

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,111 +1,67 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'objspace'
-cs__scoped_require 'contrast/components/interface'
+require 'objspace'
+require 'singleton'
+require 'contrast/components/heap_dump'
+require 'contrast/components/logger'
+require 'contrast/utils/head_dump_utils_extend'
 
 module Contrast
   module Utils
     # Implementation of a heap dump util to automate generation
-    class HeapDumpUtil
-      include Contrast::Components::Interface
-      access_component :logging, :heap_dump
+    class HeapDumpUtil < Contrast::Agent::WorkerThread
+      extend Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Logger::InstanceMethods
+      extend Contrast::Components::HeapDump::InstanceMethods
+      include Contrast::Utils::HeadDumpExtend
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'
 
       class << self
-        def run
-          return unless heap_dump_enabled?
-
-          log_enabled_warning
-          dir = heap_dump_control[:path]
-          Dir.mkdir(dir) unless Dir.exist?(dir)
-          return unless File.writable?(dir)
-
-          delay = heap_dump_control[:delay]
-          Contrast::Agent::Thread.new do
-            logger.info("HEAP DUMP THREAD INITIALIZED.  WAITING #{ delay } SECONDS TO BEGIN.")
-            sleep(delay)
-            capture_heap_dump
-          end
-        rescue StandardError => e
-          logger.info(LOG_ERROR_DUMPS, e)
+        def enabled?
+          heap_dump_enabled?
         end
 
-        def log_enabled_warning
-          dir    = heap_dump_control[:path]
-          window = heap_dump_control[:window]
-          count  = heap_dump_control[:count]
-          delay  = heap_dump_control[:delay]
-          clean  = heap_dump_control[:clean]
-
-          logger.info <<~WARNING
-            *****************************************************
-            ********      HEAP DUMP HAS BEEN ENABLED     ********
-            *** APPLICATION PROCESS WILL EXIT UPON COMPLETION ***
-            *****************************************************
-
-            Heap dump is a debugging tool that snapshots the entire
-            state of the Ruby VM. It is an exceptionally expensive
-            process, and should only be used to debug especially
-            pernicious errors.
-
-            It will write multiple memory snaphots, which are liable
-            to be multiple gigabytes in size.
-            They will be named "[unix timestamp]-heap.dump",
-            e.g.: 1020304050-heap.dump
-
-            It will then call Ruby `exit()`.
+        def control
+          heap_dump_control
+        end
+      end
 
-            If this is not your specific intent, you can (and should)
-            disable this option in your Contrast config file.
+      def start_thread!
+        return unless Contrast::Utils::HeapDumpUtil.enabled?
 
-            HEAP DUMP PARAMETERS:
-            \t[write files to this directory]             dir:     #{ dir    }
-            \t[wait this many seconds in between dumps]   window:  #{ window }
-            \t[heap dump this many times]                 count:   #{ count  }
-            \t[wait this many seconds into app lifetime]  delay:   #{ delay  }
-            \t[perform gc pass before dump]               clean:   #{ clean  }
+        control = Contrast::Utils::HeapDumpUtil.control
+        log_enabled_warning
+        dir = control[:path]
+        FileUtils.mkdir_p(dir)
+        return unless File.writable?(dir)
 
-            *****************************************************
-            ********        YOU HAVE BEEN WARNED         ********
-            *****************************************************
-          WARNING
+        delay = control[:delay]
+        @_thread = Contrast::Agent::Thread.new do
+          logger.info("HEAP DUMP THREAD INITIALIZED. WAITING #{ delay } SECONDS TO BEGIN.")
+          sleep(delay)
+          capture_heap_dump
         end
+      rescue StandardError => e
+        logger.info(LOG_ERROR_DUMPS, e)
+        nil
+      end
 
-        def capture_heap_dump
-          dir    = heap_dump_control[:path]
-          window = heap_dump_control[:window]
-          count  = heap_dump_control[:count]
-          clean  = heap_dump_control[:clean]
-          logger.info(nil, 'HEAP DUMP MAIN LOOP')
-          ObjectSpace.trace_object_allocations_start
-          count.times do |i|
-            logger.info(nil, "STARTING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
-            output = "#{ Time.now.to_f }-heap.dump"
-            output = File.join(dir, output)
-            begin
-              logger.info(nil, "OPENING FILE #{ dir }/#{ output } FOR HEAP DUMP")
-              file = File.new(output, FILE_WRITE_FLAGS)
-              if clean
-                logger.info(nil, 'PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
-                GC.start
-              end
-              ObjectSpace.dump_all(output: file)
-              logger.info(nil, "FINISHING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
-            ensure
-              file.close
-            end
-            sleep(window)
+      def snapshot_heap dir, clean
+        output = "#{ Time.now.to_f }-heap.dump"
+        output = File.join(dir, output)
+        begin
+          logger.info('OPENING HEADUMP FILE', dir: dir, file: output)
+          file = File.new(output, FILE_WRITE_FLAGS)
+          if clean
+            logger.info('PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
+            GC.start
           end
+          ObjectSpace.dump_all(output: file)
         ensure
-          ObjectSpace.trace_object_allocations_stop
-          logger.info(nil, '*****************************************************')
-          logger.info(nil, '********        HEAP DUMP HAS CONCLUDED      ********')
-          logger.info(nil, '***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
-          logger.info(nil, '*****************************************************')
-          exit # We weren't kidding!
+          file.close
         end
       end
     end

data/lib/contrast/utils/input_classification_base.rb

@@ -0,0 +1,169 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This module will include all the similar information for all input classifications
+        # between different rules
+        module InputClassificationBase
+          UNKNOWN_KEY = 'unknown'
+          THRESHOLD = 90.cs__freeze
+          WORTHWATCHING_THRESHOLD = 10.cs__freeze
+          include Contrast::Agent::Reporting::InputType
+          include Contrast::Agent::Reporting::ScoreLevel
+          include Contrast::Components::Logger::InstanceMethods
+
+          KEYS_NEEDED = [COOKIE_VALUE, PARAMETER_VALUE, JSON_VALUE, MULTIPART_VALUE, XML_VALUE, DWR_VALUE].cs__freeze
+
+          # Input Classification stage is done to determine if an user input is
+          # DEFINITEATTACK or to be ignored.
+          #
+          # @param rule_id [String] Name of the protect rule.
+          # @param input_type [Symbol, Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis] Holds all the results from the
+          #                                                       agent analysis from the current
+          #                                                       Request.
+          # @return ia [Contrast::Agent::Reporting::InputAnalysis, nil] with updated results.
+          def classify rule_id, input_type, value, input_analysis
+            return unless (rule = Contrast::PROTECT.rule(rule_id))
+            return unless rule.applicable_user_inputs.include?(input_type)
+            return unless input_analysis.request
+
+            Array(value).each do |val|
+              Array(val).each do |v|
+                next unless v
+
+                result = create_new_input_result(input_analysis.request, rule.rule_name, input_type, v)
+                append_result(input_analysis, result)
+              end
+            end
+
+            input_analysis
+          rescue StandardError => e
+            logger.debug("An Error was recorded in the input classification of the #{ rule_id }")
+            logger.debug(e)
+            nil
+          end
+
+          # Creates new isntance of InputAnalysisResult with basic info.
+          #
+          # @param rule_id [String] The name of the Protect Rule.
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          # @param path [String] the path of the current request context.
+          #
+          # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
+          def new_ia_result rule_id, input_type, path, value = nil
+            res = Contrast::Agent::Reporting::InputAnalysisResult.new
+            res.rule_id = rule_id
+            res.input_type = input_type
+            res.path = path
+            res.value = value
+            res
+          end
+
+          # This methods checks if input is value that matches a key in the input.
+          #
+          # @param request [Contrast::Agent::Request] the current request context.
+          # @param result [Contrast::Agent::Reporting::InputAnalysisResult] result to be updated.
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          #
+          # @return result [Contrast::Agent::Reporting::InputAnalysisResult] updated with key result.
+          def add_needed_key request, result, input_type, value
+            case input_type
+            when COOKIE_VALUE
+              result.key = request.cookies.key(value)
+            when PARAMETER_VALUE, URL_PARAMETER
+              result.key = request.parameters.key(value)
+            when HEADER
+              result.key = request.headers.key(value)
+            when UNKNOWN
+              result.key = UNKNOWN_KEY
+            else
+              result.key
+            end
+          rescue StandardError => e
+            logger.warn('Could not find proper key for input traced value', message: e)
+          end
+
+          # Some input types are not yet supported from the AgentLib.
+          # This will convert the type to the closet possible if viable,
+          # so that the input tracing could be done.
+          #
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @return [Integer<Contrast::AgentLib::Interface::INPUT_SET>]
+          def convert_input_type input_type
+            case input_type
+            when URI, URL_PARAMETER
+              Contrast::AGENT_LIB.input_set[:URI_PATH]
+            when BODY, DWR_VALUE, SOCKET, UNDEFINED_TYPE, UNKNOWN, REQUEST, QUERYSTRING
+              Contrast::AGENT_LIB.input_set[:PARAMETER_VALUE]
+            when HEADER
+              Contrast::AGENT_LIB.input_set[:HEADER_VALUE]
+            when MULTIPART_VALUE, MULTIPART_FIELD_NAME
+              Contrast::AGENT_LIB.input_set[:MULTIPART_NAME]
+            when JSON_ARRAYED_VALUE
+              Contrast::AGENT_LIB.input_set[:JSON_KEY]
+            when PARAMETER_NAME
+              Contrast::AGENT_LIB.input_set[:PARAMETER_KEY]
+            else
+              Contrast::AGENT_LIB.input_set[input_type]
+            end
+          rescue StandardError => e
+            logger.debug('Protect Input classification could not determine input type, falling back to default',
+                         error: e)
+            Contrast::AGENT_LIB.input_set[:PARAMETER_VALUE]
+          end
+
+          private
+
+          # This methods checks if input is tagged WORTHWATCHING or IGNORE matches value with it's
+          # key if needed and Creates new instance of InputAnalysisResult.
+          #
+          # @param request [Contrast::Agent::Request] the current request context.
+          # @param rule_id [String] The name of the Protect Rule.
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          #
+          # @return res [Contrast::Agent::Reporting::InputAnalysisResult, nil]
+          def create_new_input_result request, rule_id, input_type, value
+            return unless Contrast::AGENT_LIB
+
+            input_eval = Contrast::AGENT_LIB.eval_input(value,
+                                                        convert_input_type(input_type),
+                                                        Contrast::AGENT_LIB.rule_set[rule_id],
+                                                        Contrast::AGENT_LIB.eval_option[:PREFER_WORTH_WATCHING])
+
+            ia_result = new_ia_result(rule_id, input_type, request.path, value)
+            score = input_eval&.score || 0
+            if score >= WORTHWATCHING_THRESHOLD
+              ia_result.score_level = WORTHWATCHING
+              ia_result.ids << self::WORTHWATCHING_MATCH
+            else
+              ia_result.score_level = IGNORE
+              return
+            end
+
+            add_needed_key(request, ia_result, input_type, value) if KEYS_NEEDED.include?(input_type)
+            ia_result
+          end
+
+          def append_result ia_analysis, result
+            ia_analysis.results << result if result
+            ia_analysis
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,15 +1,17 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
 
 module Contrast
   module Utils
-    # This utility allows us to report invalid configurations detected in
-    # customer applications, as determined by Configuration Rules at runtime.
+    # This utility allows us to report invalid configurations detected in customer applications, as determined by
+    # Configuration Rules at runtime.
     module InvalidConfigurationUtil
-      include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -18,55 +20,39 @@ module Contrast
       # Build and report a finding for the given rule
       #
       # @param rule_id [String] the rule that was violated by the configuration
-      # @param user_provided_options [Hash] the configuration value(s) which
-      #   violated the rule
-      # @param call_location [Thread::Backtrace::Location] the location where
-      #   the bad configuration was set
+      # @param user_provided_options [Hash] the configuration value(s) which violated the rule
+      # @param call_location [Thread::Backtrace::Location] the location where the bad configuration was set
       def cs__report_finding rule_id, user_provided_options, call_location
-        finding = Contrast::Api::Dtm::Finding.new
-        finding.rule_id = rule_id
-        path = call_location.path
-        # just get the file name, not the full path
-        path = path.split(Contrast::Utils::ObjectShare::SLASH).last
-        session_id = user_provided_options[:key].to_s if user_provided_options
-
-        finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
-        finding.properties[CS__SESSION_ID] = Contrast::Utils::StringUtils.force_utf8(session_id)
-        finding.properties[CS__PATH] = Contrast::Utils::StringUtils.force_utf8(path)
-        file_path = call_location.absolute_path
-        snippet = file_snippet(file_path, call_location)
-        finding.properties[CS__SNIPPET] = Contrast::Utils::StringUtils.force_utf8(snippet)
-
-        hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
-        finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
-        finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-
-        activity = Contrast::Api::Dtm::Activity.new
-        activity.findings << finding
+        with_contrast_scope do
+          finding = build_finding(rule_id, user_provided_options, call_location)
+          return unless finding
 
-        # If assess is enabled, we can just send the activity
-        if ASSESS.enabled?
-          build_tags(activity)
-          CONTRAST_SERVICE.queue_message activity
-        # Otherwise, if the Agent isn't ready, we have to queue the messages
-        # until we know the starting state.
-        else
-          Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
         end
       rescue StandardError => e
-        logger.error(e, "Unable to build a finding for #{ rule_id }")
+        logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private
 
-      # This seems silly to pull out, but we can ONLY call this in the case
-      # where we have a configuration. Doing otherwise results in a bad error
-      # case where we try to do other things, like logging, which behave
-      # strangely without a config
-      def build_tags activity
-        activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
+      # Set the properties needed to report and subsequently render this finding on the finding given.
+      #
+      # @param rule_id [String] the rule that was violated by the configuration
+      # @param user_provided_options [Hash] the configuration value(s) which violated the rule
+      # @param call_location [Thread::Backtrace::Location] the location where the bad configuration was set
+      # @return [Contrast::Agent::Reporting::Finding]
+      def build_finding rule_id, user_provided_options, call_location
+        finding = Contrast::Agent::Reporting::Finding.new(rule_id)
+        finding.properties[CS__SESSION_ID] = user_provided_options[:key].to_s if user_provided_options
+        # just get the file name, not the full path
+        finding.properties[CS__PATH] = call_location.path.split(Contrast::Utils::ObjectShare::SLASH).last
+        finding.properties[CS__SNIPPET] = file_snippet(call_location.absolute_path, call_location)
+        finding.hash_code = Contrast::Utils::HashDigest.generate_config_hash(finding)
+        finding
       end
 
+      # @param file_path [String] full path to the file with the property
+      # @param call_location [Thread::Backtrace::Location] the location where the bad configuration was set
       def file_snippet file_path, call_location
         idx = call_location&.lineno
         if file_path && idx && File.exist?(file_path)

data/lib/contrast/utils/io_util.rb

@@ -1,60 +1,56 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Utils
     # Util for information about an IO
-    class IOUtil
-      include Contrast::Components::Interface
-
-      access_component :logging
-
-      # StringIO is a valid path because it logs directly to a string buffer
-      def self.write_permission? path
-        return false if path.nil?
-        return true if path.is_a?(StringIO)
-        return File.writable?(path) if File.exist?(path)
-
-        dir_name = File.dirname(File.absolute_path(path))
-        File.writable?(dir_name)
-      end
-
-      # We're only going to call rewind on things that we believe are safe to
-      # call it on. This method white lists those cases and returns false in
-      # all others.
-      def self.should_rewind? potential_io
-        return true if potential_io.is_a?(StringIO)
-        return false unless io?(potential_io)
-
-        should_rewind_io?(potential_io)
-      rescue StandardError => e
-        logger.debug(e, "Encountered an issue inspecting instance of #{ potential_io } - continuing without rewind")
-        false
-      end
-
-      # IO cannot be used with streams such as pipes, ttys, and sockets.
-      def self.should_rewind_io? io
-        return false if io.tty?
-
-        status = io.stat
-        return false unless status
-        return false if status.pipe?
-        return false if status.socket?
-
-        true
-      end
-
-      # A class is IO if it is a decedent or delegate of IO
-      def self.io? object
-        return true if object.is_a?(IO)
-
-        # DelegateClass, which is a Delegator, defines __getobj__ as a way to
-        # get the object that the class wraps around (delegates to)
-        return false unless object.is_a?(Delegator)
-
-        object.__getobj__.is_a?(IO)
+    module IOUtil
+      extend Contrast::Components::Logger::InstanceMethods
+
+      class << self
+        # We're only going to call rewind on things that we believe are safe to
+        # call it on. This method allow lists those cases and returns false in
+        # all others.
+        def should_rewind? potential_io
+          return true if potential_io.is_a?(StringIO)
+          return false unless io?(potential_io)
+
+          should_rewind_io?(potential_io)
+        rescue StandardError => e
+          logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
+          false
+        end
+
+        # A class is IO if it is a decedent or delegate of IO
+        def io? object
+          return true if object.is_a?(IO)
+
+          # DelegateClass, which is a Delegator, defines __getobj__ as a way to
+          # get the object that the class wraps around (delegates to)
+          return false unless object.is_a?(Delegator)
+
+          object.__getobj__.is_a?(IO)
+        end
+
+        private
+
+        # IO rewind cannot be used with streams such as pipes, ttys, and sockets or for ones which have been closed.
+        #
+        # @param io [IO] the input to check for the ability to rewind
+        # @return [Boolean] if the given IO can be rewound
+        def should_rewind_io? io
+          return false if io.closed?
+          return false if io.tty?
+
+          status = io.stat
+          return false unless status
+          return false if status.pipe?
+          return false if status.socket?
+
+          true
+        end
       end
     end
   end