contrast-agent 3.9.1 → 6.15.3

data/resources/deadzone/policy.json

@@ -1,20 +1,15 @@
 {
   "deadzones":[
     {
-      "class_name":"Rack::Request::Helpers",
+      "class_name":"RSpec::Core::Example",
       "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"content_type"
-    }, {
+      "method_visibility": "private",
+      "method_name":"finish"
+    },{
       "class_name":"Rack::Request::Helpers",
       "instance_method":true,
       "method_visibility": "public",
-      "method_name":"host_authority"
-    }, {
-      "class_name":"Rack::Request::Helpers",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"host_with_port"
+      "method_name":"content_type"
     }, {
       "class_name":"Rack::Request::Helpers",
       "instance_method":true,
@@ -50,6 +45,281 @@
       "instance_method":true,
       "method_visibility": "public",
       "method_name":"server_name"
+    }, {
+      "class_name":"Rack::Session::Cookie",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"set_session"
+    }, {
+      "class_name":"Rack::Session::Abstract::Persisted",
+      "instance_method":true,
+      "method_visibility": "private",
+      "method_name":"session_exists?",
+      "code": "https://github.com/rack/rack-session/blob/main/lib/rack/session/abstract/id.rb#L339"
+    }, {
+      "class_name":"ActionDispatch::FileHandler",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"match?",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/static.rb#L30",
+      "note": "Removable once Rails 6.0 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::Http::MimeNegotiation",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"formats",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
+    }, {
+      "class_name":"ActionDispatch::Journey::Router",
+      "instance_method":true,
+      "method_visibility": "private",
+      "method_name":"find_routes",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/journey/router.rb#L107"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"controller_class_for",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L84"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"engine_script_name=",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L158"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"remote_ip",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L286"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"request_id",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L302"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"local?",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L409"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookie_jar",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L11",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookie_jar",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L11"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"have_cookie_jar?",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L24",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"have_cookie_jar?",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L24"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"key_generator",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L32",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"key_generator",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L32"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"signed_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L36",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"signed_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L36"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L40",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L40"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_signed_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L44",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_signed_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L44"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"authenticated_encrypted_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L48",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"authenticated_encrypted_cookie_salt",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L48"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"use_authenticated_cookie_encryption",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L52",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "new": true,
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "use_authenticated_cookie_encryption",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L52"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_cookie_cipher",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L56",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"encrypted_cookie_cipher",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L56"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"signed_cookie_digest",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L60",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"signed_cookie_digest",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L60"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"secret_key_base",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L64",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"secret_key_base",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L64"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_serializer",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L68",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_serializer",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L68"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_digest",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L72",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_digest",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L76"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_same_site_protection",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L72"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_rotations",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L76",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"cookies_rotations",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L80"
+    }, {
+      "class_name":"ActionDispatch::Request",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"use_cookies_with_metadata",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/cookies.rb#L80",
+      "note": "Removable once Rails 6.1 is no longer supported"
+    }, {
+      "class_name":"ActionDispatch::RequestCookieMethods",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"use_cookies_with_metadata",
+      "code": "https://github.com/rails/rails/blob/v7.0.3/actionpack/lib/action_dispatch/middleware/cookies.rb#L84"
+    }, {
+      "class_name":"ActionDispatch::Request::Session",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"exists?",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
+    }, {
+      "class_name":"OmniAuth::Strategies::OAuth2",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"request_phase",
+      "code": "https://github.com/omniauth/omniauth-oauth2/blob/v1.7.2/lib/omniauth/strategies/oauth2.rb#L58",
+      "note": "Prevent XSS False Positive from redirect as Omniauth handles security of URL & params"
     }
   ]
 }

data/resources/inventory/policy.json

@@ -2,8 +2,8 @@
   "rules":[
     {
       "name":"data_store",
-      "applicator": "Contrast::CoreExtensions::Inventory::DataStores",
-      "applicator_method": "patched_report_data_store",
+      "applicator": "Contrast::Agent::Inventory::Policy::DataStores",
+      "applicator_method": "report_data_store",
       "required_properties": ["data_store"],
       "optional_properties": [],
       "triggers":[

data/resources/protect/policy.json

@@ -2,8 +2,8 @@
   "rules":[
     {
       "name": "cmd-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesCommandInjectionRule",
-      "applicator_method": "apply_command_injection_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesCommandInjectionRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -114,8 +114,8 @@
     },
     {
       "name": "nosql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesNoSqliRule",
-      "applicator_method": "apply_nosql_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesNoSqliRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["database"],
       "optional_properties": [],
       "triggers": [
@@ -128,6 +128,14 @@
             "database": "MongoDB"
           }
         },{
+          "class_name": "Mongo::Collection",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name": "find",
+          "properties": {
+            "database": "MongoDB"
+           }
+         },{
           "class_name": "Moped::Node",
           "method_name": "read",
           "instance_method": true,
@@ -156,8 +164,8 @@
     },
     {
       "name":"path-traversal",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesPathTraversalRule",
-      "applicator_method": "apply_path_traversal_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesPathTraversalRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["action"],
       "optional_properties": [],
       "triggers":[
@@ -251,11 +259,10 @@
           }
         }
       ]
-    },
-    {
+    }, {
       "name": "sql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesSqliRule",
-      "applicator_method": "apply_sql_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesSqliRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["index", "database"],
       "optional_properties": [],
       "triggers": [
@@ -336,8 +343,8 @@
     },
     {
       "name": "untrusted-deserialization",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesDeserializationRule",
-      "applicator_method": "apply_deserialization_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesDeserializationRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -361,8 +368,8 @@
     },
     {
       "name": "xxe",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesXxeRule",
-      "applicator_method": "apply_xxe_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesXxeRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -377,7 +384,19 @@
           "method_name": "read_io",
           "instance_method": false,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__io",
+          "applicator_method": "apply_rule__io",
+          "properties": {}
+        },{
+          "class_name": "Nokogiri::XML::Document",
+          "method_name": "parse",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Nokogiri::XML::SAX::Parser",
+          "method_name": "parse",
+          "instance_method": true,
+          "method_visibility": "public",
           "properties": {}
         },{
           "class_name": "Nokogiri::XML::SAX::Parser",
@@ -390,7 +409,7 @@
           "method_name": "parse_io",
           "instance_method": true,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__io",
+          "applicator_method": "apply_rule__io",
           "properties": {}
         },{
           "class_name": "Ox",
@@ -409,7 +428,7 @@
           "method_name": "read_data",
           "instance_method": true,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__lexer",
+          "applicator_method": "apply_rule__lexer",
           "properties": {}
         }