contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/object_share.rb

@@ -1,22 +1,20 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# rubocop:disable  Object/Freeze
+# rubocop:disable Security/Object/Freeze
 module Contrast
   module Utils
     # A utility class where a series of commonly used Strings and other
     # commonly used objects can be store and frozen to prevent unnecessary
     # duplication.
-    class ObjectShare
+    module ObjectShare
       # Strings
-      AND =           '&'
-      OR =            '||'
-      PIPE =          '|'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
       COLON =         ':'
       COMMA =         ','
+      CONTRAST_DOT =  'contrast.'
       DASH =          '-'
       DOUBLE_QUOTE =  '"'
       EQUALS =        '='
@@ -26,9 +24,9 @@ module Contrast
       HTTPS_START =   'https:'
       NEW_LINE =      "\n"
       NIL_STRING =    'nil'
+      NIL_64_STRING = 'bmls'
       PERIOD =        '.'
-      PLUS_SIGN =     '+'
-      POUND_SIGN = HASH_CHAR = '#'
+      POUND_SIGN =    '#'
       QUESTION_MARK = '?'
       RETURN =        "\r"
       SEMICOLON =     ';'
@@ -39,49 +37,27 @@ module Contrast
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'
       LEFT_ANGLE =    '<'
-      RIGHT_ANGLE =   '>'
-      LEFT_BRACKET =   '['
-      RIGHT_BRACKET =  ']'
-      LEFT_PAREN =     '('
-      RIGHT_PAREN =    ')'
       COLON_SLASH_SLASH = '://'
-      TICK =           '`'
-      BACK_TICK =      '`'
-      LEFT_CURLY =     '{'
-      RIGHT_CURLY =    '}'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
-      PERCENT =        '%'
-      LETTER_Q =       'Q'
-      OR_STRING =      'or'
+      BANG =           '!'
 
-      DOUBLE_QUOTE_ESCAPED = '&quot;'
-
-      READ_FLAG =     'r'
       WRITE_FLAG =    'w'
-      READ_WRITE_FLAG = 'rw'
 
       PARENT_PATH =   '..'
 
       RUBY = 'Ruby'
       CACHE = 'cache'
-      GEM_SUFFIX = '.gem'
 
-      CONTRAST_METHOD_START = 'cs__'
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
-      CONTRAST_MODULE_START = 'Contrast::'
-      ANONYMOUS_CLASS_MARKER = '#<'
-      DOUBLE_COLON = '::'
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze
-      EMPTY_TRIPLE = [EMPTY_STRING, EMPTY_STRING, EMPTY_STRING].freeze
 
       # RegExps
       DIGIT_REGEXP =       /[[:digit:]]/.freeze
       WHITE_SPACE_REGEXP = /\s/.freeze
       NOT_WHITE_SPACE_REGEXP = /[^\s]/.freeze
-      WINDOWS_REGEXP = /cygwin|mswin|mingw|bccwin|wince|emx/.freeze
 
       # Messages
       OVERRIDE_MESSAGE = 'A security filter prevented original response from being returned.'
@@ -90,28 +66,12 @@ module Contrast
       TRUE = 'true'
       FALSE = 'false'
 
-      CLASS = 'Class'
-      MODULE = 'Module'
-
-      BRACKET_INTERPOLATION_START = '#{'
-
       OBJECT_KEY = 'O'
-      PARAMETER_KEY = 'P'
       RETURN_KEY = 'R'
       UNKNOWN = 'unknown'
 
       INDEX = 'index'
-
-      VERSION_2_5_0 = '2.5.0'
-      VERSION_2_4_2 = '2.4.2'
-      VERSION_2_4_1 = '2.4.1'
-      VERSION_2_4_0 = '2.4.0'
-      VERSION_2_3_5 = '2.3.5'
-      VERSION_2_3_4 = '2.3.4'
-      VERSION_2_3_0 = '2.3.0'
-      VERSION_2_0_4 = '2.0.4'
-      VERSION_2_0_0 = '2.0.0'
     end
   end
 end
-# rubocop:enable  Object/Freeze
+# rubocop:enable Security/Object/Freeze

data/lib/contrast/utils/os.rb

@@ -1,47 +1,37 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/scope'
+require 'cs__os_information/cs__os_information'
+
 module Contrast
   module Utils
     # Simple utility used to make OS calls and determine state. For that state
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
+      extend Contrast::Components::Scope::InstanceMethods
+
       class << self
+        # Check current OS type
+        # returns true if check is correct or false if not
         def windows?
-          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil? if @_windows.nil?
-          @_windows
+          return @_windows unless @_windows.nil?
+
+          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil?
         end
 
         def mac?
-          @_mac ||= !(/darwin/ =~ RUBY_PLATFORM).nil? if @_mac.nil?
+          @_mac = RUBY_PLATFORM.include?('darwin') if @_mac.nil?
           @_mac
         end
 
         def unix?
-          @unix ||= !windows? if @_unix.nil?
-          @unix
+          !windows?
         end
 
         def linux?
-          @_linux ||= unix? && !OS.mac? if @_linux.nil?
-          @_linux
-        end
-
-        def running?
-          process = if Contrast::Utils::OS.windows?
-                      `tasklist /fi "imagename eq contrast-service.exe"`
-                    else
-                      `ps aux | grep contrast-servic[e]`
-                    end
-          process != ''
-        end
-
-        # check if service was killed and is a zombie process
-        # returns an array of zombie process PIDs as strings; empty array if there are none
-        def zombie_pids
-          zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
-          zombie_pid_list.split("\n")
+          (unix? and !mac?)
         end
       end
     end

data/lib/contrast/utils/patching/policy/patch_utils.rb

@@ -0,0 +1,175 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Patching
+      # This module will include all methods for different patch applies from Patch module and some other module
+      # methods from the same place, so we can ease the main module
+      module PatchUtils
+        # Given a module and method, construct an expected name for the alias by which Contrast will reference the
+        # original.
+        #
+        # @param patched_class [Module] the module being patched
+        # @param patched_method [Symbol] the method being patched
+        # @return [Symbol]
+        def build_method_name patched_class, patched_method
+          (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
+            patched_class.cs__name.gsub('::', '_').downcase +
+            Contrast::Utils::ObjectShare::UNDERSCORE +
+            patched_method.to_s).to_sym
+        end
+
+        # Given a method, return a symbol in the format
+        # <method_start>_unbound_<method_name>
+        def build_unbound_method_name patcher_method
+          "#{ Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START }unbound" \
+          "#{ Contrast::Utils::ObjectShare::UNDERSCORE }" \
+          "#{ patcher_method }".to_sym
+        end
+
+        # ===== PATCH APPLIERS =====
+        # THIS IS CALLED FROM C. Do not change the signature lightly.
+        #
+        # This method functions to call the infilter methods from our patches, allowing for analysis and reporting at
+        # the point just before the patched code is invoked.
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param method [Symbol] The method into which we're patching
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        def apply_pre_patch method_policy, method, exception, object, args
+          apply_protect(method_policy, method, exception, object, args)
+          apply_inventory(method_policy, method, exception, object, args)
+        rescue Contrast::SecurityException => e
+          # We were told to block something, so we gotta. Don't catch this one, let it get back to our Middleware or
+          # even all the way out to the framework
+          raise(e)
+        rescue StandardError => e
+          # Anything else was our bad and we gotta catch that to allow for normal application flow
+          logger.error('Unable to apply pre patch to method.', e)
+        end
+
+        # THIS IS CALLED FROM C. Do not change the signature lightly.
+        #
+        # This method functions to call the infilter methods from our patches, allowing for analysis and reporting at
+        # the point just after the patched code is invoked
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to the
+        #   invocation of the patched method.
+        # @param object [Object] The object on which the method was invoked, typically what would be returned by self.
+        # @param ret [Object] The return of the method that was invoked.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        # @param block [Proc] The block passed to the method that was invoked.
+        def apply_post_patch method_policy, preshift, object, ret, args, block
+          apply_assess(method_policy, preshift, object, ret, args, block)
+        rescue StandardError => e
+          logger.error('Unable to apply post patch to method.', e)
+        end
+
+        # Apply the Protect patch which applies to the given method.
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param method [Symbol] The method into which we're patching
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        def apply_protect method_policy, method, exception, object, args
+          return unless ::Contrast::AGENT.enabled?
+          return unless ::Contrast::PROTECT.enabled?
+
+          apply_trigger_only(method_policy&.protect_node, method, exception, object, args)
+        end
+
+        # Apply the Inventory patch which applies to the given method.
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param method [Symbol] The method into which we're patching
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        def apply_inventory method_policy, method, exception, object, args
+          return unless ::Contrast::INVENTORY.enable
+
+          apply_trigger_only(method_policy&.inventory_node, method, exception, object, args)
+        end
+
+        # Apply the Assess patches which apply to the given method.
+        #
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] Mapping of the triggers on the given
+        #   method.
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to the
+        #   invocation of the patched method.
+        # @param object [Object] The object on which the method was invoked, typically what would be returned by self.
+        # @param ret [Object] The return of the method that was invoked.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        # @param block [Proc] The block passed to the method that was invoked.
+        def apply_assess method_policy, preshift, object, ret, args, block
+          return ret unless method_policy && ::Contrast::ASSESS.enabled?
+
+          current_context = Contrast::Agent::REQUEST_TRACKER.current
+          return ret if current_context && !current_context.analyze_request?
+
+          trigger_node = method_policy.trigger_node
+
+          if trigger_node && !trigger_node.nil?
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_trigger_rule(trigger_node, object, ret, args)
+          end
+          if method_policy.source_node
+            Contrast::Agent::Assess::Policy::SourceMethod.apply_source(method_policy, object, ret, args)
+          end
+          if method_policy.propagation_node
+            Contrast::Agent::Assess::Policy::PropagationMethod.apply_propagation(
+                method_policy,
+                preshift,
+                object,
+                ret,
+                args,
+                block)
+          end
+        rescue StandardError => e
+          logger.error('Unable to assess method call.', e)
+        rescue Exception => e # rubocop:disable Lint/RescueException
+          logger.error('Unable to assess method call due to exception.', e)
+          raise(e)
+        ensure
+          ret.rewind if Contrast::Utils::IOUtil.should_rewind?(ret)
+        end
+
+        # Generic invocation of the Inventory or Protect patch which apply to the given method.
+        #
+        # @param trigger_node [Contrast::Agent::Inventory::Policy::TriggerNode] Mapping of the specific trigger on the
+        #   given method.
+        # @param method [Symbol] The method into which we're patching
+        # @param exception [StandardError] Any exception raised during the call of the patched method.
+        # @param object [Object] The object on which the method is invoked, typically what would be returned by self.
+        # @param args [Array<Object>] The arguments passed to the method being invoked.
+        def apply_trigger_only trigger_node, method, exception, object, args
+          return unless trigger_node
+
+          # If that rule only applies in the case of an exception being thrown and there's no exception here, move
+          # along, or vice versa
+          return if trigger_node.on_exception && !exception
+          return if !trigger_node.on_exception && exception
+
+          # Each patch has an applicator that handles logic for it. Think of this as being similar to propagator
+          # actions, most closely resembling CUSTOM - they all have a common interface but their own logic based on
+          # what's in the method(s) they've been patched into.
+          # Each patch also knows the method of its applicator. Some things, like AppliesXxeRule, have different
+          # methods depending on the library patched. This lets us handle the boilerplate of patching while still
+          # allowing for custom handling of the methods.
+          applicator_method = trigger_node.applicator_method
+          # By calling send like this, we can reuse all the patching. We `send` to the given method of the given class
+          # (applicator) since they all accept the same inputs
+          trigger_node.applicator.send(applicator_method, method, exception, trigger_node.properties, object, args)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/patching/policy/patcher_utils.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Patching
+      # This module will include patch methods from Patcher module
+      # in case of need to add new logic to the Patcher
+      # please do it here
+      module PatcherUtils
+        # This method is called by TracePointHook to instrument a specific class during a require
+        # or eval of dynamic class definition
+        def patch_specific_module mod
+          with_contrast_scope do
+            mod_name = mod.cs__name
+            return unless Contrast::Utils::ClassUtil.truly_defined?(mod_name)
+            return if ::Contrast::AGENT.skip_instrumentation?(mod_name)
+
+            load_patches_for_module(mod_name)
+
+            return if all_module_names.none?(mod_name)
+
+            module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
+            patch_into_module(module_data)
+            all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
+          rescue StandardError => e
+            logger.error('Unable to patch module', e, module: mod_name)
+          end
+        end
+
+        # We did it, team. We found a patcher(s) that applies to the given
+        # class (or module) and the given method. Time to do some tracking.
+        #
+        # @param mod [Module] the module in which the patch should be
+        #   placed.
+        # @param methods [Array(Symbol)] all the instance or singleton
+        #   methods in this mod.
+        # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
+        #   the policy that applies to the given method_name.
+        # @return [Boolean] if patched, either by this invocation or a
+        #   previous, or not
+        def patch_method mod, methods, method_policy
+          return false unless methods&.any? # don't even build the name if there are no methods
+
+          if Contrast::Utils::ClassUtil.prepended_method?(mod, method_policy)
+            Contrast::Agent::Patching::Policy::Patch.instrument_with_prepend(mod, method_policy)
+          else
+            Contrast::Agent::Patching::Policy::Patch.instrument_with_alias(mod, methods, method_policy)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/reporting/application_activity_batch_utils.rb

@@ -0,0 +1,89 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/application_activity'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Utils
+    module Reporting
+      # ApplicationActivityBatchUtils handles batching and reporting of ApplicationActivity events to TeamServer at a
+      # set interval
+      module ApplicationActivityBatchUtils
+        DEFAULT_REPORTING_INTERVAL_MS = 30_000.cs__freeze
+
+        # @return [Integer] time when activity batch was created in ms
+        def batch_age
+          @_batch_age ||= Contrast::Utils::Timer.now_ms
+        end
+
+        # Merge a ApplicationActivity into the ApplicationActivityBatch
+        # @param activity [Contrast::Agent::Reporting::ApplicationActivity] from a RequestContext
+        def add_activity_to_batch activity
+          return unless activity
+          return if activity.defend.attackers.empty?
+
+          activity_batch.query_count += activity.query_count
+          activity_batch.routes << activity.routes
+          activity_batch.routes.flatten!
+          merge_attackers(activity)
+          activity_batch.attach_inventory(activity.inventory) unless activity.inventory.empty?
+        end
+
+        # If the batch can be reported, mask the data and add it to the reporting queue, then reset the activity_batch
+        def report_batch
+          return unless report_batch?
+          return unless (reporter = Contrast::Agent.reporter)
+
+          Contrast::Agent::Reporting::Masker.mask(activity_batch)
+          reporter&.send_event(activity_batch)
+          reset_activity_batch
+        end
+
+        # @return Contrast::Agent::Reporting::ApplicationActivity
+        def activity_batch
+          return @activity_batch unless @activity_batch.nil?
+
+          reset_activity_batch
+          @activity_batch
+        end
+
+        private
+
+        def merge_attackers activity
+          return if activity.defend.attackers.empty?
+
+          activity.defend.attackers.each do |attacker|
+            if (existing = activity_batch.defend.find_existing_attacker_activity(attacker))
+              attacker.protection_rules.each_key do |key|
+                activity_batch.defend.attach_existing(existing, attacker, key)
+              end
+            else
+              activity_batch.defend.attackers << attacker
+            end
+          end
+        end
+
+        # resets the activity_batch object and it's batch_age
+        def reset_activity_batch
+          @_batch_age = Contrast::Utils::Timer.now_ms
+          @activity_batch = Contrast::Agent::Reporting::ApplicationActivity.new
+        end
+
+        # We need to check for attackers to see if the batch is newly created along side with the age check.
+        # In the reader we reset the batch and the age is correct but the event is empty. We need to prevent
+        # sending of empty event.
+        #
+        # @return [Boolean] if the age of the batch is outside the reporting interval
+        def report_batch?
+          activity_batch.defend.attackers.any? && reporting_interval <= (Contrast::Utils::Timer.now_ms - batch_age)
+        end
+
+        # @return [Integer] interval to report to TeamServer in seconds
+        def reporting_interval
+          Contrast::AGENT.polling.batch_reporting_interval_ms.to_i || DEFAULT_REPORTING_INTERVAL_MS
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/request_utils.rb

@@ -0,0 +1,96 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # used in Contrast::Agent::Request
+    module RequestUtils
+      # Return a flattened hash of params with realized paths for keys, in
+      # addition to a separate, valueless, entry for each nest key.
+      # See RUBY-621 for more details.
+      # { key : { nested_key : ['x','y','z' ] } }
+      # becomes
+      # {
+      #   key[nested_key][0] : 'x'
+      #   key[nested_key][1] : 'y'
+      #   key[nested_key][2] : 'z'
+      #   key :                ''
+      #   nested_key :         ''
+      # }
+      # @return params_hash [Hash]
+      def normalize_params val, prefix: nil
+        # In non-recursive invocations, val should always be a Hash
+        # (rather than breaking this out into two methods)
+        case val
+        when Tempfile
+          # Skip if it's the auto-generated value from rails when it handles
+          # file uploads. The file name will still be sent to SR for analysis.
+          {}
+        when Hash
+          res = val.each_with_object({}) do |(k, v), hash|
+            k = Contrast::Utils::StringUtils.force_utf8(k)
+            nested_prefix = prefix.nil? ? k : "#{ prefix }[#{ k }]"
+            hash[k] = Contrast::Utils::ObjectShare::EMPTY_STRING
+            hash.merge!(normalize_params(v, prefix: nested_prefix))
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        when Enumerable
+          idx = 0
+          res = {}
+          while idx < val.length
+            res.merge!(normalize_params(val[idx], prefix: "#{ prefix }[#{ idx }]"))
+            idx += 1
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        else
+          { prefix => Contrast::Utils::StringUtils.force_utf8(val) }
+        end
+      end
+
+      # Read the response body and rewind.
+      # A well behaved middleware would read the IO object and then rewind.
+      #
+      # @return body [String]
+      def read_body body
+        return body if body.is_a?(String)
+
+        begin
+          can_rewind = Contrast::Utils::DuckUtils.quacks_to?(body, :rewind)
+          # if we are after a middleware that failed to rewind
+          body.rewind if can_rewind
+          body.read
+        rescue StandardError => e
+          logger.error('Error in attempt to read body', message: e.message)
+          logger.trace('With Stack', e)
+          body.to_s
+        ensure
+          # be a good citizen and rewind
+          body.rewind if can_rewind
+        end
+      end
+
+      # @param multipart_data [Object<Hash>]
+      # @param current_names [Hash]
+      # @return current_names [Hash<Name =>file_name]
+      def traverse_parsed_multipart multipart_data, current_names
+        return current_names unless multipart_data
+
+        multipart_data.each_value do |data_value|
+          next unless data_value.is_a?(Hash)
+
+          tempfile = data_value[:tempfile]
+          if tempfile.nil?
+            traverse_parsed_multipart(data_value, current_names)
+          else
+            name = data_value[:name].to_s
+            file_name = data_value[:filename].to_s
+            current_names[name] = file_name
+          end
+        end
+        current_names
+      end
+    end
+  end
+end

data/lib/contrast/utils/resource_loader.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
     # ResourceLoader can attempt to read a file from a predefined resource directory
-    class ResourceLoader
+    module ResourceLoader
       RESOURCES = 'resources'
 
       # __FILE__/../../../resources