contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb

@@ -1,73 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # This class is called by our patches to determine if a CSRF
-          # vulnerability exists within an application. It is used through a
-          # CUSTOM propagation in order to capture that a Database call was
-          # made in response to a request that did not have the Contrast CSRF
-          # token.
-          class CsrfApplicator
-            include Contrast::Components::Interface
-            access_component :logging, :analysis, :scope
-
-            CS__CSRF_LOG_MSG = 'applying CSRF assess rule'
-
-            class << self
-              def csrf_tagger patcher, preshift, _ret, _block
-                return unless rule&.enabled?
-
-                idx = patcher.sources[0].to_i
-                args = preshift.args
-                return unless args&.length.to_i > idx
-
-                sql = args[idx]
-                return unless sql
-
-                with_contrast_scope do
-                  logger.debug(nil, CS__CSRF_LOG_MSG)
-                  rule.record_db_state_change(
-                      Contrast::Agent::REQUEST_TRACKER.current,
-                      sql)
-                end
-              end
-
-              def apply_csrf_rule sql
-                context = Contrast::Agent::REQUEST_TRACKER.current
-
-                return unless context&.app_loaded?
-                return unless ASSESS.enabled?
-                return unless sql
-
-                rule = Contrast::Agent::FeatureState.instance.assess_rule(
-                    Contrast::Agent::Assess::Rule::Csrf::NAME)
-                return unless rule&.enabled?
-
-                with_contrast_scope do
-                  logger.debug(CS__CSRF_LOG_MSG)
-                  rule.record_db_state_change(context, sql)
-                end
-              rescue StandardError => e
-                logger.warn(e, 'Error running CSRF assess rule')
-              end
-
-              private
-
-              def rule
-                @_rule ||= Contrast::Agent::FeatureState.instance.assess_rule(
-                    Contrast::Agent::Assess::Rule::Csrf::NAME)
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb

@@ -1,132 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # Watchers are how those Rules which do not act on dataflow function.
-          # This one is used by the CSRF rule to determine if a request was
-          # made in a way that is susceptible to a CSRF attack.
-          class Watcher < Contrast::Agent::Assess::Rule::ResponseWatcher
-            def supports? context
-              return false unless super(context)
-              return false unless user_agent?(context)
-              return false unless form_content_type?(context)
-              return false unless form_method?(context)
-              return false if empty_get?(context)
-
-              true
-            end
-
-            X_REQUESTED_WITH = 'X-REQUESTED-WITH'
-            # ignore this request if X-Requested-With is set
-            def x_requested_with? context
-              !context.request.normalized_request_headers[X_REQUESTED_WITH].nil?
-            end
-
-            USER_AGENT = 'USER-AGENT'
-            # ignore this request if User-Agent is NOT set
-            # since that indicates this isn't a browser interaction
-            def user_agent? context
-              !context.request.normalized_request_headers[USER_AGENT].nil?
-            end
-
-            CONTENT_TYPE = 'CONTENT-TYPE'
-            FORM_TYPES = %w[
-              text/plain
-              multipart/form-data
-              application/x-www-form-urlencoded
-            ].cs__freeze
-            # ignore this request if the Content-Type is NOT set
-            # to a form content type
-            def form_content_type? context
-              type = context.request.content_type
-              # We need to account for the charset being part of the header. It doesn't
-              # affect how we determine CSRF-ability or not
-              type = type.split(Contrast::Utils::ObjectShare::SEMICOLON)[0] if type
-              FORM_TYPES.include?(type)
-            end
-
-            FORM_METHODS = %w[GET POST].cs__freeze
-            # ignore this request if the request method
-            # is not one that can be set with forms
-            def form_method? context
-              FORM_METHODS.include?(context.request.request_method)
-            end
-
-            GET = 'GET'
-            # ignore this request if the method is get
-            # and the query string is empty
-            def empty_get? context
-              request = context.request
-              request.request_method ==
-                  GET &&
-                  (request.query_string.nil? || request.query_string.empty?)
-            end
-
-            # If a parameter contains 'csrf' or 'token', we consider
-            # it to be a guard against CSRF and therefore determine
-            # that this request is not vulnerable.
-            CSRF_PATTERN = /csrf/i.cs__freeze
-            TOKEN_PATTERN = /token/i.cs__freeze
-            def vulnerable? context
-              # having the property 'csrf.token.checked' indicates
-              # that a CSRF check was preformed at some point during
-              # this request, so we consider it to not be vulnerable
-              return false if context.get_property(CHECKED)
-
-              params = context.request.parameters
-              params.each_key do |key|
-                return false if key.match?(CSRF_PATTERN)
-                return false if key.match?(TOKEN_PATTERN) && looks_like_token?(params[key])
-              end
-              # having no actions means there's no vulnerability
-              return false unless context.get_property(STATE_CHANGING_ACTIONS_KEY)&.any?
-
-              true
-            end
-
-            MINIMUM_CSRF_TOKEN_SIZE = 8
-            MAXIMUM_CSRF_TOKEN_SIZE = 24
-            TOKEN_REGEXP = /^[A-Za-z0-9]*$/.cs__freeze
-            def looks_like_token? value
-              return false unless value
-
-              values = [value]
-              values.each do |parameter|
-                next unless parameter
-
-                length = parameter.length
-                next if length < MINIMUM_CSRF_TOKEN_SIZE
-                next if length > MAXIMUM_CSRF_TOKEN_SIZE
-                return true if parameter.match?(TOKEN_REGEXP)
-              end
-              false
-            end
-
-            DATA_KEY = 'actions'
-            def build_finding context
-              actions = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-              return if actions.nil? || actions.empty?
-
-              string = actions.map(&:to_h).to_json
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Agent::Assess::Rule::Csrf::NAME
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-              hash_code = Contrast::Utils::HashDigest.generate_response_hash(finding)
-              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
-              finding.properties[DATA_KEY] = Contrast::Utils::StringUtils.force_utf8(string)
-              finding
-            rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for CSRF')
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf.rb

@@ -1,66 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # The Ruby implementation of the CSRF Assess Rule.
-        class Csrf < Contrast::Agent::Assess::Rule::ResponseScanningRule
-          NAME = 'csrf'
-          def name
-            NAME
-          end
-
-          DB_STATE_CHANGE = 'db'
-          ACTION_LIMIT = 3
-          QUERY_SIZE_LIMIT = 50
-          STATE_CHANGING_ACTIONS_KEY = 'csrf.statechange.actions'
-          def record_db_state_change context, query
-            return unless context
-
-            changes = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-            changes ||= []
-            return unless changes.length < ACTION_LIMIT
-
-            return unless state_change?(query)
-
-            action = Contrast::Agent::Assess::Rule::Csrf::CsrfAction.new
-            action.type = DB_STATE_CHANGE
-            action.evidence = query[0..QUERY_SIZE_LIMIT]
-
-            changes << action
-
-            context.add_property(STATE_CHANGING_ACTIONS_KEY, changes)
-          end
-
-          STATE_CHANGE_QUERY_ACTIONS = %w[
-            insert
-            update
-            delete
-            drop
-            create
-            alter
-            upsert
-          ].cs__freeze
-          # Returns true if the given query starts with any
-          # of the STATE_CHANGE_QUERY_ACTIONS listed above
-          def state_change? query
-            return false unless query.is_a?(String) && !query.empty?
-
-            query.downcase.start_with?(*STATE_CHANGE_QUERY_ACTIONS)
-          end
-
-          # some watchers keep state and need to be reset in each request.
-          # this one is not one of those.
-          def watcher
-            @_watcher ||= Contrast::Agent::Assess::Rule::Csrf::Watcher.new
-          end
-
-          # Indicates if this request has been checked for a CSRF token
-          CHECKED = 'csrf.token.checked'
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/redos.rb

@@ -1,68 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # A regexp is only vulnerable to REDOS if it's going to run
-        # with pathologically bad performance.
-        # We report a vulnerability if the regexp is liable to run
-        # with quadratic time for some input.
-        # This vastly errs on the side of false positives.
-        class Redos < Contrast::Agent::Assess::Rule::Base
-          class << self
-            NAME = 'redos'
-            def name
-              NAME
-            end
-
-            def regexp_complexity_check context, trigger_node, source, object, ret, invoked, *args
-              # we can arrive here either from:
-              #   regexp =~ string
-              #   string =~ regexp
-              #   regexp.match string
-              #
-              # so object/args[0] can be string/regexp or regexp/string.
-              regexp = object.is_a?(Regexp) ? object : args[0]
-              string = object.is_a?(String) ? object : args[0]
-
-              # (1) regexp must be exploitable
-              return unless regexp_vulnerable?(regexp)
-
-              # (2) regexp must evaluate against user input
-              if trigger_node.violated?(string) # rubocop:disable Style/GuardClause
-                Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, invoked + 1, args)
-              end
-            end
-
-            protected
-
-            VULNERABLE_PATTERN = /[\[(].*?[\[(].*?[\])][*+?].*?[\])][*+?]/.cs__freeze
-
-            # Does the regexp
-            # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/redos.md
-            def regexp_vulnerable? regexp
-              # A pattern is considered vulnerable if it has 2 or more levels of nested multi-matching.
-              # A level is defined as any set of opening and closing control characters immediately followed by a multi match control character.
-              # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS,
-              # or MULTI_MATCH_CHARS that is not immediately preceded by an escaping \ character.
-              # OPENING_CHARS are ( and [ CLOSING_CHARS are ) and ] MULTI_MATCH_CHARS are +, *, and ?
-
-              # Nota bene about Regexp#to_s:  it doesn't necessarily give you the original Regexp back
-              # (in the sense of `my_str == Regexp.new(my_str).to_s`), it gives you a Regexp that
-              # will have the same functional characteristics as the original.
-              # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
-              # Regexp#source will give you the original source.
-              # TODO RUBY-683, would we ever get a hit on one but not the other?
-
-              # Use #match? because it doesn't fill out global variables
-              # in the way match or =~ do.
-              VULNERABLE_PATTERN.match? regexp.source
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_scanning_rule.rb

@@ -1,47 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # Those rules which function by scanning the Response body in order to
-        # detect vulnerabilities. These rules should each have their own
-        # Contrast::Agent::Assess::RuleResponseWatcher.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseScanningRule < Contrast::Agent::Assess::Rule::Base
-          def watcher
-            # raise(
-            #     NotImplementedError,
-            #     'A child rule should have overridden the watcher method')
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def generate_hash finding
-            Contrast::Utils::HashDigest.generate_response_hash(finding)
-          end
-
-          def postfilter context
-            findings = watcher.postfilter(context) if watcher && context
-            return unless findings
-
-            if findings.is_a?(Array)
-              findings.each do |finding|
-                send_report(finding) if finding
-              end
-            else
-              send_report(findings)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_watcher.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # A watcher focused on the Response body, parsing out vulnerabilities
-        # therein.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseWatcher < Contrast::Agent::Assess::Rule::Watcher
-          def postfilter context
-            return unless supports?(context)
-            return unless vulnerable?(context)
-
-            build_finding(context)
-          end
-
-          def vulnerable? _context
-            raise(
-                NotImplementedError,
-                'A child rule should have overridden the vulnerable? method')
-          end
-
-          def build_finding _context
-            Contrast::Api::Dtm::Finding.new
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/watcher.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # Watchers are how those Rules which do not act on dataflow function.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class Watcher
-          def supports? context
-            return false if context.request.static_request?
-            return false unless context.response
-            return false if undesired_response_code? context.response.response_code
-            return false if undesired_response_type? context.response.content_type
-
-            true
-          end
-
-          UNDESIRED_RESPONSE_CODES = [301, 302, 307, 404, 410, 500].cs__freeze
-          def undesired_response_code? code
-            UNDESIRED_RESPONSE_CODES.include?(code)
-          end
-
-          def undesired_response_type? _type
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule.rb

@@ -1,18 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      # This is the base module for our assess rule classes. It is intended to
-      # facilitate the patching of the application for Assess functionality. Any
-      # class under this namespace should be required here, providing a single
-      # point of require for this functionality.
-      module Rule
-      end
-    end
-  end
-end
-
-cs__scoped_require 'contrast/agent/assess/rule/base'
-cs__scoped_require 'contrast/agent/assess/rule/provider'

data/lib/contrast/agent/assess.rb

@@ -1,44 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    # This is the base module for our assess classes. It is intended to
-    # facilitate the patching of the application for Assess functionality. Any
-    # class under this namespace should be required here, providing a single
-    # point of require for this functionality.
-    module Assess
-      cs__scoped_require 'contrast/agent/module_data'
-      cs__scoped_require 'contrast/agent/rewriter'
-      cs__scoped_require 'contrast/agent/assess/policy/preshift'
-
-      cs__scoped_require 'contrast/utils/prevent_serialization'
-
-      # Rules - generic
-      cs__scoped_require 'contrast/agent/assess/rule'
-      cs__scoped_require 'contrast/agent/assess/rule/base'
-      cs__scoped_require 'contrast/agent/assess/rule/response_scanning_rule'
-      cs__scoped_require 'contrast/agent/assess/rule/watcher'
-      cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
-
-      # Dynamic Sources
-      cs__scoped_require 'contrast/agent/assess/policy/dynamic_source_factory'
-
-      # Rule: CSRF
-      cs__scoped_require 'contrast/agent/assess/rule/csrf'
-      cs__scoped_require 'contrast/agent/assess/rule/csrf/csrf_applicator'
-      cs__scoped_require 'contrast/agent/assess/rule/csrf/csrf_action'
-      cs__scoped_require 'contrast/agent/assess/rule/csrf/csrf_watcher'
-
-      # Rule: REDOS
-      cs__scoped_require 'contrast/agent/assess/rule/redos'
-
-      # reporting / tracking
-      cs__scoped_require 'contrast/agent/assess/insulator'
-      cs__scoped_require 'contrast/agent/assess/properties'
-      cs__scoped_require 'contrast/agent/assess/frozen_properties'
-      cs__scoped_require 'contrast/agent/assess/tag'
-      cs__scoped_require 'contrast/agent/assess/contrast_event'
-    end
-  end
-end

data/lib/contrast/agent/at_exit_hook.rb

@@ -1,33 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # This module adds an at_exit hook for us to send messages that may be lost at process exit
-    module AtExitHook
-      include Contrast::Components::Interface
-      access_component :logging, :contrast_service
-
-      TERMINATION_NOTICE = 'at_exit invoked, host application terminating'
-
-      def self.exit_hook
-        @_exit_hook ||= begin
-                          at_exit do
-                            logger.debug(TERMINATION_NOTICE)
-
-                            context = Contrast::Agent::REQUEST_TRACKER.current
-                            CONTRAST_SERVICE.send_message(context.activity) if context
-
-                            logger.debug(" - current PID  #{ @pid  }")
-                            logger.debug(" - current PPID #{ @ppid }")
-                            logger.debug(" - process PID  #{ Process.pid  }")
-                            logger.debug(" - process PPID #{ Process.ppid }")
-                          end
-                          true
-                        end
-      end
-    end
-  end
-end