contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/middleware.rb

@@ -1,350 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'ipaddr'
-cs__scoped_require 'json'
-cs__scoped_require 'rack'
-
-cs__scoped_require 'contrast/security_exception'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/agent/service_heartbeat'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/heap_dump_util'
-
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/freeze_util'
-cs__scoped_require 'contrast/utils/service_sender_util'
-cs__scoped_require 'contrast/utils/service_response_util'
-
-module Contrast
-  module Agent
-    # This class allows the Agent to plug into the Rack middleware stack,
-    # providing hooks to relevant application events, such as request start and
-    # application code.
-    class Middleware
-      include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :agent, :analysis, :config, :scope
-
-      attr_reader :app
-
-      LOG_DEBUG_MIDDLEWARE_ENV     = 'middleware: log environment'
-      LOG_DEBUG_MIDDLEWARE_LIB     = 'middleware: instrument shared libraries'
-      LOG_DEBUG_MIDDLEWARE_START   = 'middleware: startup agent'
-      LOG_DEBUG_MIDDLEWARE_SERVICE = 'middleware: starting service'
-
-      # allows the Agent to function as a middleware
-      #
-      # @param app [Rack::Application] the application to be instrumented
-      # @param _legacy_param [nil] was a flag we no longer need, but Sinatra may call it
-      def initialize app, _legacy_param = nil
-        @app = app
-
-        # TODO: RUBY-545 nomenclature here needs to be updated.
-        #   enabled/initialized are really only reflective of whether we were
-        #   able to parse the config, which is the bare minimum for the agent
-        #   to do anything.
-        unless AGENT.enabled?
-          logger.error('Contrast middleware initializer detected an early-stage setup failure (likely config parse).  Disabling.')
-          # ensure the agent is disabled (probably redundant)
-          AGENT.disable!
-          return
-        end
-
-        logger.debug_with_time(LOG_DEBUG_MIDDLEWARE_ENV) do
-          settings.log_environment
-          settings.log_configuration
-          settings.log_specific_libraries
-          settings.log_all_libraries
-        end
-
-        # Initialization order should be:
-        # - start separate service sending threads
-        # - start heartbeat thread, which triggers service startup
-        # - start patching to achieve instrumentation
-
-        logger.debug_with_time(LOG_DEBUG_MIDDLEWARE_SERVICE) do
-          # get threads ready to poll for messages on the queue
-          run_service_sender_thread
-
-          # sends first message to service, which triggers service startup
-          run_service_heartbeat_thread
-        end
-
-        # Default instrumentation
-        logger.debug_with_time(LOG_DEBUG_MIDDLEWARE_LIB) do
-          AGENT.run_instrumentation
-        end
-
-        Contrast::Agent::AtExitHook.exit_hook
-      end
-
-      def settings
-        Contrast::Agent::FeatureState.instance
-      end
-
-      LOG_DEBUG_MIDDLEWARE_START_CALL = 'middleware: startup agent (call)'
-      # def _call env
-      def call env
-        Contrast::Utils::HeapDumpUtil.run
-
-        if AGENT.enabled?
-          response = call_with_agent(env)
-          with_contrast_scope { do_static_analysis_catchup }
-          response
-        else
-          call_without_agent(env)
-        end
-      end
-
-      def call_without_agent env
-        app.call(env)
-      end
-
-      REQUEST_PATH = 'REQUEST_PATH'
-      LOG_DEBUG_REQUEST = 'HTTP request cycle'
-      def call_with_agent env
-        rack_request = generate_request(env)
-
-        context = Contrast::Agent::RequestContext.new(rack_request, true) # 'true' here is legacy, by the time we're here, we're ready
-
-        # default response
-        streaming = false
-        # make the context available for the lifecycle of this request
-        Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
-          # record entire time
-          logger.debug_with_time(LOG_DEBUG_REQUEST) do
-            # process filters that can short circuit application processing
-            with_contrast_scope do
-              context.service_extract_request
-              prefilter(context)
-            end
-
-            # run application by passing request down the Rack chain using
-            # the original env
-            response = application_code(env)
-
-            # if streaming, allow for early return with application response
-            streaming = possibly_streaming?(env)
-            if streaming
-              with_contrast_scope { postfilter(context, streaming) }
-              return response
-            end
-
-            # update context with final response information
-            context.extract_after(response)
-
-            # process filters that look at response headers and body
-            with_contrast_scope { postfilter(context) }
-          end
-        end
-
-        # return the response stored in the context in case any postfilter rules
-        # updated the response data
-        context&.response&.rack_response || response
-
-      # handle security exception
-      rescue StandardError => e
-        handle_exception(e)
-      ensure
-        begin
-          handle_ensure(context, streaming)
-        rescue Exception => e # rubocop:disable Lint/RescueException
-          logger.error(e, 'Exception raised while flushing messages to Contrast service!')
-          raise
-        end
-      end
-
-      LOG_WARN_FRAMEWORK_PARSE = 'Unable to generate framework specific request - falling back to Rack'
-      # Given the rack environment of this call, generate a framework specific
-      # request object to bind to this context. In the event that multiple
-      # supported frameworks are defined OR we cannot determine the framework
-      # currently in use or there is an exception during request generation, we
-      # will fall back on Rack::Request object
-      def generate_request env
-        rails_defined = defined?(Rails)
-        sinatra_defined = defined?(Sinatra) && defined?(Sinatra::Request)
-
-        if rails_defined && !sinatra_defined
-          # code from /lib/action_cable/connection/base
-          environment = Rails.application.env_config.merge(env) if defined?(Rails.application) && Rails.application
-          ActionDispatch::Request.new(environment || env)
-        # !defined? currently redundant, won't be if we have more frameworks
-        elsif sinatra_defined && !rails_defined
-          Sinatra::Request.new(env)
-        else # many OR none
-          Rack::Request.new(env)
-        end
-      rescue StandardError => e
-        logger.warn(e, LOG_WARN_FRAMEWORK_PARSE)
-        Rack::Request.new(env)
-      end
-
-      LOG_ERROR_STREAM_CHECK = 'Unable to check for streaming'
-      ACTION_CONTROLLER_INSTANCE = 'action_controller.instance'
-      # First check to see if an action could potentially be streaming a response
-      def possibly_streaming? env
-        return false unless defined?(ActionController::Live)
-
-        env[ACTION_CONTROLLER_INSTANCE].cs__class.included_modules.include?(ActionController::Live)
-      rescue StandardError => e
-        logger.warn(LOG_ERROR_STREAM_CHECK, e)
-      end
-
-      LOG_ERROR_ENSURE = 'Context not defined in middleware ensure.'
-      # Send a server activity message and an application activity message
-      # and return response
-      def handle_ensure context, streaming
-        if context
-          logger.debug('Middleware request lifecycle complete; flushing context activity to Contrast service.')
-          Contrast::Utils::GemfileReader.instance.generate_library_usage(context.activity)
-          [context.server_activity, context.activity, context.observed_route].each do |message|
-            CONTRAST_SERVICE.send_message message
-          end
-        else
-          logger.error(LOG_ERROR_ENSURE)
-        end
-        return unless streaming
-
-        context.reset_activity
-      end
-
-      SECURITY_EXCEPTION_MARKER = 'Contrast::SecurityException'
-      LOG_RETHROW_ERROR = 'Re-throwing original error'
-      # We're only going to suppress SecurityExceptions indicating a blocked attack.
-      # And, only if the config.agent.ruby.exceptions.capture? is set
-      def handle_exception exception
-        if exception.is_a?(Contrast::SecurityException) ||
-              exception.message&.include?(SECURITY_EXCEPTION_MARKER)
-
-          exception_control = Contrast::Agent::FeatureState.instance.exception_control
-          raise exception unless exception_control[:enable]
-
-          [exception_control[:status], {}, [exception_control[:message]]]
-        else
-          # Log original re-raise
-          logger.debug(exception, LOG_RETHROW_ERROR)
-          raise exception
-        end
-      end
-
-      LOG_DEBUG_PREFILTER = 'prefilter'
-      LOG_ERROR_PREFILTER = 'Unexpected exception during prefilter'
-      # Iterate through rules that only depend upon the request object.
-      def prefilter context
-        return unless context.app_loaded?
-
-        logger.debug_with_time(LOG_DEBUG_PREFILTER) do
-          prefilter_assess(context) if ASSESS.enabled? && context.analyze_request?
-          prefilter_protect(context) if PROTECT.enabled?
-        end
-      rescue Contrast::SecurityException => e
-        logger.warn("RASP threw security exception in prefilter: exception=#{ e.message }")
-        raise e
-      rescue StandardError => e
-        logger.error(LOG_ERROR_PREFILTER, e)
-      end
-
-      def prefilter_assess context
-        rules = ASSESS.rules
-        logger.debug("Assess: Running #{ rules.length } rules in prefilter.")
-        prefilter_rules(rules, context)
-      end
-
-      def prefilter_protect context
-        rules = PROTECT.rules
-        logger.debug("Protect: Running #{ rules.length } rules in prefilter.")
-        prefilter_rules(rules, context)
-      end
-
-      def prefilter_rules rules, context
-        rules.each do |_, rule|
-          rule.prefilter(context)
-        end
-      end
-
-      LOG_DEBUG_APPLICATION = 'application'
-      # Run the next level of the Rack stack as normal
-      def application_code env
-        logger.debug_with_time(LOG_DEBUG_APPLICATION) do
-          app.call(env)
-        end
-      rescue Contrast::SecurityException => e
-        logger.info("RASP threw security exception in application code: exception=#{ e.message }")
-        raise e
-      end
-
-      LOG_DEBUG_POSTFILTER = 'postfilter'
-      LOG_ERROR_POSTFILTER = 'Unexpected exception during postfilter'
-      # Iterate through rules that depend on the full response object
-      def postfilter context, streaming = false
-        return unless context.app_loaded?
-
-        logger.debug_with_time(LOG_DEBUG_POSTFILTER) do
-          if ASSESS.enabled? && context.analyze_response?
-            logger.debug("Assess:\tRunning #{ ASSESS.rules.length } rules in postfilter.")
-            postfilter_rules(ASSESS.rules, context, streaming)
-          end
-
-          if PROTECT.enabled?
-            logger.debug("Protect:\tRunning #{ PROTECT.rules.length } rules in postfilter.")
-            postfilter_rules(PROTECT.rules, context, streaming)
-          end
-        end
-      rescue Contrast::SecurityException => e
-        logger.warn("RASP threw security exception: exception=#{ e.message }")
-        raise e
-      rescue StandardError => e
-        logger.error(LOG_ERROR_POSTFILTER, e)
-      end
-
-      # Iterate through a list of rules with the current context and the full response body
-      def postfilter_rules rules, context, streaming
-        rules.each do |_, rule|
-          if !streaming || rule.stream_safe?
-            rule.postfilter(context)
-          else
-            logger.debug("Skipping rule: #{ rule.name } in streamed response.")
-          end
-        end
-      end
-
-      def run_service_heartbeat_thread
-        # Rspec stubs over this method for simplicity's sake in testing.
-        # Take care if you refactor this back into #initialize.
-        Contrast::Agent::ServiceHeartbeat.new.start
-      end
-
-      def run_service_sender_thread
-        # Rspec stubs over this method for simplicity's sake in testing.
-        # Take care if you refactor this back into #initialize.
-        Contrast::Utils::ServiceSenderUtil.start
-      end
-
-      LOG_DEBUG_MW_INV = 'middleware: send inventory'
-      LOG_WARN_STATIC_ANALYSIS = 'Unable to run post-initialization static analysis'
-      # this is memoized, should only be meaningful after the first agented
-      # HTTP request
-      def do_static_analysis_catchup
-        @_do_static_analysis_catchup ||= begin
-                                           # Everything in here should be asynchronous, as we need to return
-                                           # the HTTP response from middleware ASAP.
-
-                                           # Review already-loaded inventory
-                                           logger.debug_with_time('initializer: report loaded gemset') do
-                                             Contrast::Utils::GemfileReader.instance.map_loaded_classes
-                                           end
-
-                                           # Report already-loaded inventory
-                                           logger.debug_with_time(LOG_DEBUG_MW_INV) do
-                                             settings.send_inventory_message
-                                           end
-
-                                           true
-                                         end
-      rescue StandardError => e
-        logger.warn(LOG_WARN_STATIC_ANALYSIS, e)
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,88 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # Encapsulate common code for protect rules that do their
-        # input analysis on Speedracer rather in ruby code
-        class BaseService < Contrast::Agent::Protect::Rule::Base
-          def name
-            'base-service'
-          end
-
-          def block_message
-            'Contrast Security Protect Rule Triggered. Response blocked.'
-          end
-
-          def infilter? context
-            return false unless context&.speedracer_input_analysis&.results
-            return false unless enabled?
-            return false if protect_excluded_by_code?
-
-            true
-          end
-
-          # Override for rules that need the response
-          # Currently postfilter can be applied to streamed responses,
-          # if any logic within postfilter changes to modify the response
-          # streamed responses will break
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-            return if mode == :NO_ACTION || mode == :PERMIT
-
-            result = find_postfilter_attacker(context, nil)
-            return unless result&.samples&.any?
-
-            append_to_activity(context, result)
-            return unless result.response == :BLOCKED
-
-            raise Contrast::SecurityException.new(self, "#{ name } triggered in postfilter. Response blocked.")
-          end
-
-          protected
-
-          def gather_ia_results context
-            context.speedracer_input_analysis.results.select do |ia_result|
-              ia_result.rule_id == name
-            end
-          end
-
-          def find_attacker context, potential_attack_string, **kwargs
-            ia_results = gather_ia_results(context)
-            find_attacker_with_results(context, potential_attack_string, ia_results, **kwargs)
-          end
-
-          # Allows for the InputAnalysis from service to be extracted early
-          def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
-            logger.debug("checking: #{ name } vectors=#{ ia_results.length } in '#{ potential_attack_string }'")
-
-            result = nil
-            ia_results.each do |ia_result|
-              if potential_attack_string
-                idx = potential_attack_string.index(ia_result.value)
-                next unless idx
-
-                result = build_attack_with_match(context, ia_result, result, potential_attack_string, **kwargs)
-              else
-                result = build_attack_without_match(context, ia_result, result, **kwargs)
-              end
-            end
-            result
-          end
-
-          private
-
-          def find_postfilter_attacker context, potential_attack_string, **kwargs
-            ia_results = gather_ia_results(context)
-            ia_results.select! do |ia_result|
-              ia_result.score_level == :DEFINITEATTACK
-            end
-            find_attacker_with_results(context, potential_attack_string, ia_results, **kwargs)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/cmd_injection.rb

@@ -1,156 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Command Injection rule.
-        class CmdInjection < Contrast::Agent::Protect::Rule::BaseService
-          include Contrast::Components::Interface
-          access_component :logging, :contrast_service
-
-          NAME = 'cmd-injection'
-          CHAINED_COMMAND_CHARS = /[;&|<>]/.cs__freeze
-
-          def name
-            NAME
-          end
-
-          def infilter context, classname, method, command
-            return nil unless infilter?(context)
-
-            ia_results = gather_ia_results(context)
-            return nil if ia_results.empty?
-
-            if Contrast::Agent::FeatureState.instance.in_new_process?
-              logger.debug('Running cmd-injection infilter within new process - creating new context')
-              context = Contrast::Agent::RequestContext.new(context.request.rack_request)
-              Contrast::Agent::REQUEST_TRACKER.update_current_context(context)
-            end
-
-            result = find_attacker_with_results(context, command, ia_results, **{ classname: classname, method: method })
-            result ||= report_command_execution(context, command, **{ classname: classname, method: method })
-            return nil unless result
-
-            append_to_activity(context, result)
-            if %I[exec `].include?(method)
-              # TODO: RUBY-737
-              # Kernel#exec replaces the current process and does not go through at_exit hooks
-              # Kernel#` runs as a subshell - messages appended here do not seem to be present in the original process?
-              CONTRAST_SERVICE.send_message(context.activity)
-            end
-
-            return unless blocked?
-
-            raise Contrast::SecurityException.new(
-                self,
-                "Command Injection rule triggered. Call to #{ classname }.#{ method } blocked.")
-          end
-
-          def build_attack_with_match context, input_analysis_result, result, candidate_string, **kwargs
-            return result if mode == :NO_ACTION || mode == :PERMIT
-
-            result ||= build_attack_result(context)
-            update_successful_attack_response(context, input_analysis_result, result, candidate_string)
-            append_sample(context, input_analysis_result, result, candidate_string, **kwargs)
-            result
-          end
-
-          protected
-
-          # Because results are not necessarily on the context across
-          # processes; extract early and pass into the method
-          def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
-            logger.debug("checking: #{ name } in '#{ potential_attack_string }'")
-            result = super(context, potential_attack_string, ia_results, **kwargs)
-            if result.nil? && potential_attack_string
-              result = find_probable_attacker(
-                  context,
-                  potential_attack_string,
-                  ia_results,
-                  **kwargs)
-            end
-            result
-          end
-
-          # Build a subclass of the RaspRuleSample using the query string and the
-          # evaluation
-          def build_sample context, input_analysis_result, candidate_string, **_kwargs
-            sample = build_base_sample(context, input_analysis_result)
-            sample.cmdi = Contrast::Api::Dtm::CmdInjectionDetails.new
-
-            command = candidate_string || input_analysis_result.value
-            command = Contrast::Utils::StringUtils.protobuf_safe_string(command)
-            sample.cmdi.command = command
-
-            # This is a special case where the user input is UNKNOWN_USER_INPUT but
-            # we want to send the attack value
-            if input_analysis_result.nil?
-              ui = Contrast::Api::Dtm::UserInput.new
-              ui.input_type = :UNKNOWN
-              ui.value = command
-              sample.user_input = ui
-            end
-
-            sample
-          end
-
-          private
-
-          def report_command_execution context, command, **kwargs
-            return unless report_any_command_execution?
-            return nil if protect_excluded_by_code?
-
-            build_attack_with_match(context, nil, nil, command, **kwargs)
-          end
-
-          def find_probable_attacker context, potential_attack_string, ia_results, **kwargs
-            result = nil
-            if chained_command?(potential_attack_string) # this is probably an attack
-              most_likely = nil
-              ia_results.each do |input_analysis_result|
-                next unless chained_command?(input_analysis_result.value)
-
-                most_likely = input_analysis_result
-                break
-              end
-            end
-            return result unless most_likely
-
-            result ||= build_attack_with_match(
-                context,
-                most_likely,
-                result,
-                potential_attack_string,
-                **kwargs)
-            return nil if result.nil?
-
-            log_rule_matched(context, most_likely, mode, potential_attack_string)
-            result
-          end
-
-          def chained_command? command
-            return true if CHAINED_COMMAND_CHARS.match(command)
-
-            false
-          end
-
-          # Part of the Hardening for Command Injection detection is the
-          # ability to detect and prevent any command execution from within the
-          # application. This check determines if that hardening has been
-          # enabled.
-          # @return [Boolean] if the agent should report all command
-          #   executions.
-          def report_any_command_execution?
-            Contrast::Agent::FeatureState.instance.report_any_command_execution?
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb

@@ -1,103 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'uri'
-
-# This class is used by the CSRF rule to determine if the given Request is
-# susceptible to CSRF / if the rule applies to it.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator # rubocop:disable Style/ClassAndModuleChildren
-  include Contrast::Components::Interface
-  access_component :logging
-
-  def can_ignore_check? request
-    if !form_submittable_method?(request)
-      logger.debug("Ignoring method #{ request.request_method } for URI #{ request.uri }")
-      true
-    elsif ajax_request?(request)
-      logger.debug("Ignoring Ajax request for URI #{ request.uri }")
-      true
-    elsif empty_post?(request)
-      logger.debug("Ignoring empty POST request for URI #{ request.uri }")
-      true
-    elsif !form_content_type?(request)
-      logger.debug("Ignoring POST request with Content-Type #{ request.content_type } for URI #{ request.uri }")
-      true
-    elsif request.static_request?
-      logger.debug("Ignoring static request for URI #{ request.uri }")
-      true
-    elsif origin_is_referer?(request)
-      logger.debug("Ignoring equivalent origin-referer for URI #{ request.uri }")
-      true
-    elsif login_page?(request)
-      logger.debug("Ignoring possible login page for URI #{ request.uri }")
-      true
-    else
-      false
-    end
-  rescue StandardError => e
-    logger.warn(e, 'Unable to determine if CSRF can be ignored')
-  end
-
-  POST_METHOD = 'POST'
-  def form_submittable_method? request
-    POST_METHOD == request.request_method
-  end
-
-  REQUESTED_WITH = 'X-REQUESTED-WITH'
-  def ajax_request? request
-    requested_with = request.header_value(REQUESTED_WITH)
-    !requested_with.nil? && !requested_with.empty?
-  end
-
-  USER_AGENT = 'USER-AGENT'
-  def empty_user_agent? request
-    agent = request.header_value(USER_AGENT)
-    agent.nil? || agent.empty?
-  end
-
-  def empty_post? request
-    request.request_body_str.empty? && (request.query_string.nil? || request.query_string.empty?)
-  end
-
-  FORM_CONTENT_TYPES = %w[text/plain multipart/form-data application/x-www-form-urlencoded].cs__freeze
-
-  def form_content_type? request
-    content_type = request.content_type
-    return true if content_type.nil? || content_type.empty?
-
-    content_type.start_with?(*FORM_CONTENT_TYPES)
-  end
-
-  ORIGIN = 'ORIGIN'
-  REFERER = 'REFERER'
-  def origin_is_referer? request
-    origin = request.header_value(ORIGIN)
-    referer = request.header_value(REFERER)
-    return false unless origin && referer
-    return false if origin.empty? || referer.empty?
-
-    origin = trim_origin(origin)
-    referer = URI(referer).host
-    origin == referer
-  end
-
-  HTTP = 'http://'
-  HTTPS = 'https://'
-  def trim_origin origin_header
-    origin_header = if origin_header.to_s.start_with?(HTTP, HTTPS)
-                      URI(origin_header).host
-                    else
-                      idx = origin_header.index(Contrast::Utils::ObjectShare::COLON)
-                      idx.nil? ? origin_header : origin_header[0, idx]
-                    end
-    origin_header
-  end
-
-  LOGIN_MARKERS = %w[login auth j_security verify validate sessions].cs__freeze
-  def login_page? request
-    url = request.url.downcase
-    LOGIN_MARKERS.any? { |marker| url.index(marker) }
-  end
-end