contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/class_reopener.rb

@@ -1,238 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'ripper'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/components/interface'
-
-# This method is left purposefully at the top level namespace. Moving it
-# elsewhere will break functionality as it executes evaluations against the
-# namespace from which it is called -- ie putting it in Contrast would make all
-# changes it intends for Foo happen to Contrast::Foo instead
-#
-# @param class_name [String] the name of the class in which the eval will
-#   redefine functionality
-# @param content [String] the String content that will function as the code in
-#   the given class
-def unbound_eval class_name, content
-  # Yuck, this is a top-level method that has to break encapsulation
-  # in order to access scoping!
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope!
-  eval(content) # rubocop:disable Security/Eval
-rescue Exception # rubocop:disable Lint/RescueException
-  Contrast::Agent::SettingsState.log_error("Unable to perform unbound eval of new content for #{ class_name }.")
-ensure
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope!
-end
-
-module Contrast
-  module Agent
-    # Used for Ruby 2.4 & 2.5 to allow us to rewrite those methods which have
-    # interpolation in them.
-    # @deprecated Changes to this class are discouraged as this approach is
-    #   being phased out with support for those language versions.
-    class ClassReopener
-      include Contrast::Components::Interface
-      access_component :logging
-
-      END_NEW_LINE = "end\n"
-      PROTECTED_WITH_NEW_LINE = "protected\n"
-      PRIVATE_WITH_NEW_LINE = "private\n"
-      CLASS_SELF_LINE = "class << self\n"
-
-      attr_reader :public_singleton_methods, :class_module_path, :class_name, :files, :is_class, :name_space,
-                  :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
-
-      def initialize module_data
-        @class_module_path = module_data.name
-        clazz = module_data.mod
-        @is_class = clazz.is_a?(Class)
-        @public_instance_methods = []
-        @protected_instance_methods = []
-        @private_instance_methods = []
-        @public_singleton_methods = []
-        @files = {}
-        @name_space = []
-        @class_name = nil
-        @locations = Hash.new { |h, k| h[k] = [] }
-        gather_modules
-      end
-
-      # Indicates if any methods were rewritten for this class.
-      #
-      # @return [Boolean]
-      def staged_changes?
-        public_singleton_methods.any? ||
-            public_instance_methods.any? ||
-            protected_instance_methods.any? ||
-            private_instance_methods.any?
-      end
-
-      # Indicates if this class was written from the given location.
-      #
-      # @param source_location [Array<String, Integer>] the result of a
-      #   Method#source_location call
-      # @return [Boolean]
-      def written_from_location? source_location
-        return false unless source_location
-
-        file = source_location[0]
-        location = source_location[1]
-        locations[file].include?(location)
-      end
-
-      # Marks that this class was written from the given location.
-      #
-      # @param source_location [Array<String, Integer>] the result of a
-      #   Method#source_location call
-      # @return [Boolean]
-      def written_from_location! source_location
-        return false unless source_location
-
-        file = source_location[0]
-        location = source_location[1]
-        locations[file] << location
-      end
-
-      # Evaluate the patches that have been staged for this class, replacing
-      # the method definitions with those our rewrite.
-      def commit_patches
-        return unless staged_changes?
-
-        content = build_content
-        valid = Ripper.sexp(content)
-        unbound_eval(class_name, content) if !!valid && !class_name.empty?
-      end
-
-      # Find the sourcecode of the method at the given location and return it
-      # if it is complete and compilable.
-      #
-      # @param location [Array<String, Integer>] the result of a
-      #   Method#source_location call
-      # @param method_name [Symbol] the name of the method defined at the given
-      #   location
-      # @return [String, nil] the code defining the method or nil if no valid
-      #   code could be found.
-      def source_code location, method_name
-        file_name = location[0]
-        line_number = location[1]
-        return unless file_name && line_number
-        return unless File.exist?(file_name) && File.readable?(file_name)
-        return if File.empty?(file_name)
-
-        files[file_name] = File.readlines(file_name) unless files.key?(file_name)
-        lines = files[file_name]
-        code = +''
-        # location#line_number is 1 based, arrays are 0 based
-        line_number -= 1
-        lines[line_number..-1].each do |line|
-          code << line
-          next unless compiles?(code)
-          break if complete?(code)
-        end
-        unless complete?(code) && compiles?(code)
-          logger.warn("Failed to capture #{ method_name } in #{ file_name } at #{ line_number } for rewriting.")
-          return
-        end
-        code
-      end
-
-      private
-
-      def gather_modules
-        return if class_module_path.nil?
-
-        segments = class_module_path.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
-        @class_name = segments.last
-        current = nil
-        segments[0..-2].each do |chunk|
-          defined = current ? current.cs__const_defined?(chunk) : Module.cs__const_defined?(chunk)
-          next unless defined
-
-          current = current ? current.cs__const_get(chunk) : Module.cs__const_get(chunk)
-          if current.is_a?(Class)
-            name_space << [chunk, Class]
-          elsif current.is_a?(Module)
-            name_space << [chunk, Module]
-          end
-        end
-      end
-
-      # code which ends with a , or \ is incomplete.
-      #
-      # @param code [String] the text to determine if complete
-      # @return [Boolean]
-      def complete? code
-        code !~ /[,\\]\s*\z/
-      end
-
-      # code which does not resolve to RubyVM::InstructionSequence does not
-      # compile
-      #
-      # @param code [String] the text to determine if compiles
-      # @return [Boolean]
-      def compiles? code
-        old_verbose = $VERBOSE
-        $VERBOSE = nil
-        RubyVM::InstructionSequence.compile(code)
-        true
-      rescue SyntaxError => _e
-        false
-      ensure
-        $VERBOSE = old_verbose
-      end
-
-      def build_content
-        content = +''
-        name_space.each do |arr|
-          name = arr[0]
-          type = arr[1]
-          if type == Class
-            content << "class #{ name }\n"
-          elsif type == Module
-            content << "module #{ name }\n"
-          end
-        end
-
-        # Set the name to be a class or module
-        content << if is_class
-                     "class #{ class_name }\n"
-                   else
-                     "module #{ class_name }\n"
-                   end
-
-        # Recreate the updated class methods
-        if public_singleton_methods.any?
-          content << CLASS_SELF_LINE
-          content << public_singleton_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-          content << END_NEW_LINE
-        end
-
-        # Recreate the updated instance methods
-        if public_instance_methods.any?
-          content << public_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        if protected_instance_methods.any?
-          content << PROTECTED_WITH_NEW_LINE
-          content << protected_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        if private_instance_methods.any?
-          content << PRIVATE_WITH_NEW_LINE
-          content << private_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        content << END_NEW_LINE
-        name_space.length.times do
-          content << END_NEW_LINE
-        end
-        content
-      end
-    end
-  end
-end

data/lib/contrast/agent/disable_reaction.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # A Reaction from TeamServer which indicates the Agent should be disabled,
-    # typically because some configuration setting did not satisfy requirements
-    # set by the Organization's Administrator
-    class DisableReaction
-      include Contrast::Components::Interface
-      access_component :logging, :agent
-
-      def self.run _reaction, level
-        logger.with_level(
-            nil,
-            'Contrast received instructions to disable itself - Disabling now',
-            level)
-        AGENT.disable!
-      end
-    end
-  end
-end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -1,190 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # Exclusions are ways for the User to tell the Agent to ignore sections of
-    # the Application. If a request or an event matches one of these, the
-    # functions of the Agent are suppressed for that request or event.
-    class ExclusionMatcher
-      include Contrast::Components::Interface
-      access_component :logging
-
-      def initialize excl
-        @exclusion = excl
-        @protect = @exclusion.protect
-        @assess = @exclusion.assess
-
-        handle_wildcard_input
-        handle_wildcard_url
-        handle_wildcard_code
-      end
-
-      # According to the docs for exclusions, user input applies to all inputs if
-      # the name supplied is an '*' or '.*'. The name matcher does NOT support
-      # regexp beyond this.
-      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
-      def handle_wildcard_input
-        return unless @exclusion.input_name
-
-        @wildcard_input = @exclusion.input_name == '.*' ||
-            @exclusion.input_name == Contrast::Utils::ObjectShare::ASTERISK
-      end
-
-      # According to the docs for exclusions, urls apply to all urls if the url
-      # supplied is '/.*' or if the URL mode is all. Otherwise, the URL supplied is
-      # to be treated as a regular expression that must match the entire URL
-      # against which it is tested.
-      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
-      def handle_wildcard_url
-        @wildcard_url = match_all?
-        return if @wildcard_url
-        return unless @exclusion.urls&.any?
-
-        @wildcard_url ||= @exclusion.urls.any? { |test| test == '/.*' }
-        return if @wildcard_url
-
-        @urls = []
-        @exclusion.urls.each do |url|
-          url_pattern = build_regexp(url, true, true)
-          @urls << url_pattern if url_pattern
-        end
-      end
-
-      # According to the docs for exclusions, code applies to the entire stacktrace
-      # of the caller, and can act as a regexp. Per our user instructions in the
-      # Contrast UI, these comparisons must be done at the end of the input.
-      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
-      def handle_wildcard_code
-        return unless @exclusion.blacklist&.any?
-
-        @wildcard_exclusions = []
-        @exclusion.blacklist.each do |code|
-          class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
-          class_pattern = build_regexp(class_name, false, true)
-          method_pattern = build_regexp(method_name)
-          next unless class_pattern && method_pattern
-
-          @wildcard_exclusions << [class_pattern, method_pattern]
-        end
-      end
-
-      def build_regexp pattern, start_anchor = false, end_anchor = false
-        pattern = Contrast::Utils::ObjectShare::CARROT + pattern if start_anchor
-        pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
-        Regexp.compile(pattern)
-      rescue RegexpError => e
-        logger.error(e, "Unable to generate a pattern for #{ pattern }. It will not be used for exclusion matching.")
-      end
-
-      def protect?
-        @protect
-      end
-
-      def assess?
-        @assess
-      end
-
-      def url?
-        @exclusion.type == :URL
-      end
-
-      def input?
-        @exclusion.type == :INPUT
-      end
-
-      def code?
-        @exclusion.type == :CODE
-      end
-
-      def name
-        @exclusion.name
-      end
-
-      def match_all?
-        @exclusion.match_strategy == :ALL
-      end
-
-      # Determine if the given rule is excluded by this exclusion.
-      # In this case, the `protection_rules` being empty means apply to all rules,
-      # not no rules
-      #
-      # @param rule - the id of the rule which we're checking for exclusion
-      def protection_rule? rule
-        protect? &&
-            (@exclusion.protection_rules.empty? ||
-                @exclusion.protection_rules.include?(rule)
-            )
-      end
-
-      # Determine if the given rule is excluded by this exclusion.
-      # In this case, the `assessment_rules` being empty means apply to all rules,
-      # not no rules
-      #
-      # @param rule - the id of the rule which we're checking for exclusion
-      def assess_rule? rule
-        assess? &&
-            (@exclusion.assessment_rules.empty? ||
-                @exclusion.assessment_rules.include?(rule)
-            )
-      end
-
-      def match_url? url
-        return false unless url?
-        return true if @wildcard_url
-
-        @urls.any? { |test| url.match?(test) }
-      end
-
-      def match_input? value, type
-        return false unless input?
-
-        exclusion_type = @exclusion.input_type
-        case type
-        when :PARAMETER_NAME, :PARAMETER_VALUE
-          return exclusion_type == :PARAMETER && value_match?(value)
-        when :COOKIE_NAME, :COOKIE_VALUE
-          return exclusion_type == :COOKIE && value_match?(value)
-        when :HEADER
-          return exclusion_type == :HEADER && value_match?(value, false)
-        when :BODY
-          return exclusion_type == :BODY
-        when :QUERYSTRING
-          return exclusion_type == :QUERYSTRING
-        end
-
-        false
-      end
-
-      def value_match? value, case_sensitive = true
-        return true if @wildcard_input
-
-        if case_sensitive
-          value == @exclusion.input_name
-        else
-          @exclusion.input_name.casecmp(value).zero?
-        end
-      end
-
-      def match_code? stack_trace
-        return false unless code?
-        return false if @wildcard_exclusions&.empty?
-
-        @wildcard_exclusions.each do |code|
-          class_name = code[0]
-          method_name = code[1]
-          stack_trace.each do |location|
-            next unless location.base_label.match?(method_name)
-            next unless location.path.match?(class_name)
-
-            return true
-          end
-        end
-
-        false
-      end
-    end
-  end
-end