contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb

@@ -1,85 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/random_util'
-
-# This class is used by the CSRF rule to inject the Contrast CSRF token into
-# the Response's body, allowing for the detection of CSRF attacks.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector # rubocop:disable Style/ClassAndModuleChildren
-  TKN_NAME = 'cs_csrf_tkn'
-  def token_name
-    TKN_NAME
-  end
-
-  SESSION_TOKEN_PREFIX = '__CONTRAST__'
-  def token_key
-    @_token_key ||= SESSION_TOKEN_PREFIX + token_name
-  end
-
-  def javascript
-    @_javascript ||= build_javascript
-  end
-
-  SCRIPT_LOC = File.join('csrf', 'inject.js').cs__freeze
-  NAME_MARKER = '!TOKEN_NAME!'
-  VALUE_MARKER = '!TOKEN_VALUE!'
-  def build_javascript
-    script = Contrast::Utils::ResourceLoader.load(SCRIPT_LOC)
-    script&.sub!(NAME_MARKER, TKN_NAME)
-    script
-  end
-
-  CSRF_TOKEN_LENGTH = 8
-  def get_expected_token context
-    cookies = context.request.request_cookies
-    token = cookies[token_key]
-    return token if token
-    return unless context.response
-
-    build_token(context)
-  end
-
-  def build_token context
-    token = Contrast::Utils::RandomUtil.secure_random_string(CSRF_TOKEN_LENGTH)
-    context&.response&.set_header(token_key, token)
-    token
-  end
-
-  CONTENT_TYPE = 'CONTENT-TYPE'
-
-  def wedge_token? response
-    return true unless response
-
-    content_type = response.header(CONTENT_TYPE)
-    return true unless content_type
-
-    content_type = content_type.to_s
-    !content_type.start_with?(*DATA_CONTENT_TYPES)
-  end
-
-  END_BODY_TAG = %r{</body>}i.cs__freeze
-  def do_injection context
-    return unless wedge_token?(context&.response)
-
-    body_string = context&.response&.body
-    return unless body_string
-
-    index = body_string.index(END_BODY_TAG)
-    return unless index
-
-    injection = get_expected_token(context)
-    return unless injection
-
-    injection = javascript.sub(VALUE_MARKER, injection)
-    body_string.insert(index, injection)
-    context&.response&.update_body(body_string)
-  end
-
-  DATA_CONTENT_TYPES = [
-    'image/', 'audio/', 'video/',
-    'application/json', 'application/xml',
-    'application/octet', 'application/force',
-    'text/json', 'text/xml'
-  ].cs__freeze
-end

data/lib/contrast/agent/protect/rule/csrf.rb

@@ -1,118 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'rack'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/timer'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Cross-Site Request Forgery
-        # rule.
-        class Csrf < Contrast::Agent::Protect::Rule::Base
-          NAME = 'csrf'
-
-          def name
-            NAME
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def request_evaluator
-            @_request_evaluator ||= Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator.new
-          end
-
-          def token_injector
-            @_token_injector ||= Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector.new
-          end
-
-          BLOCK_MESSAGE = 'CSRF rule triggered. Request blocked.'
-
-          def prefilter context
-            return unless enabled? && mode != :NO_ACTION
-
-            request = context.request
-            return if request_evaluator.can_ignore_check?(request)
-
-            parameters = request.parameters
-            return unless parameters&.any?
-
-            tokens = parameters[token_injector.token_name]
-            expected_token = token_injector.get_expected_token(context)
-            return if valid_token?(expected_token, tokens)
-
-            # unexpected token is interpreted as an attack with a match
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.input_type = :BODY
-            ia_result.value = build_attack_string(context.request)
-
-            result = build_attack_with_match(
-                context,
-                ia_result,
-                nil,
-                expected_token,
-                details: build_details(expected_token, tokens))
-
-            append_to_activity(context, result)
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
-          end
-
-          def valid_token? expected, actual_tokens
-            actual_tokens&.include?(expected)
-          end
-
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-
-            token_injector.do_injection(context)
-          end
-
-          def build_sample context, evaluation, _url, **kwargs
-            sample = build_base_sample(context, evaluation)
-            sample.csrf = kwargs[:details]
-            sample
-          end
-
-          # Build a subclass of the RaspRuleSample using the query string and the
-          # evaluation
-          def build_details expected, actual_tokens
-            details = Contrast::Api::Dtm::CsrfDetails.new
-            details.name = Contrast::Utils::StringUtils.protobuf_safe_string(token_injector.token_name)
-            details.expected = Contrast::Utils::StringUtils.protobuf_safe_string(expected)
-            presented = build_presented_token(actual_tokens)
-            details.presented = Contrast::Utils::StringUtils.protobuf_safe_string(presented)
-            details
-          end
-
-          def build_presented_token actual_tokens
-            return Contrast::Utils::ObjectShare::EMPTY_STRING unless actual_tokens&.any?
-
-            actual_tokens.first
-          end
-
-          # Convert the request parameters into an attack string
-          def build_attack_string request
-            arr = []
-            request.dtm.normalized_request_params.each_with_index do |(name, value), index|
-              arr << Contrast::Utils::ObjectShare::AND unless index.zero?
-              arr += [name.to_s, Contrast::Utils::ObjectShare::EQUALS, value.values.to_s]
-            end
-            if arr.empty?
-              request.query_string
-            else
-              arr.join
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,80 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect HTTP Method Tampering rule.
-        class HttpMethodTampering < Contrast::Agent::Protect::Rule::BaseService
-          NAME = 'method-tampering'
-          STANDARD_METHODS = %w[GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH].cs__freeze
-
-          def name
-            NAME
-          end
-
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-
-            logger.debug("#{ name } postfilter...")
-            return if normal_request?(context)
-
-            # The only way to be here in postfilter with a result is if the rule mode was MONITOR
-            ia_results = gather_ia_results(context)
-            return if ia_results.empty?
-
-            # does the status code start with 4 or 5? Rails responds with 404 (but java is checking 501)
-            response_code = context&.response&.response_code
-            return unless response_code
-
-            method = ia_results.first.value
-            result = if response_code.to_s.start_with?('4', '5')
-                       build_attack_without_match(
-                           context,
-                           nil,
-                           nil,
-                           method: method,
-                           response_code: response_code)
-                     else
-                       build_attack_with_match(
-                           context,
-                           nil,
-                           nil,
-                           nil,
-                           method: method,
-                           response_code: response_code)
-                     end
-            append_to_activity(context, result) if result
-          end
-
-          protected
-
-          def build_sample context, evaluation, _candidate_string, **kwargs
-            sample = build_base_sample(context, evaluation)
-            sample.user_input.value = kwargs[:method]
-
-            sample.method_tampering = Contrast::Api::Dtm::HttpMethodTamperingDetails.new
-            sample.method_tampering.method = Contrast::Utils::StringUtils.protobuf_safe_string(kwargs[:method])
-            code = kwargs[:response_code] || -1
-            sample.method_tampering.response_code = code.to_i
-            sample
-          end
-
-          def build_user_input _evaluation
-            input = Contrast::Api::Dtm::UserInput.new
-            input.input_type = :METHOD
-            input
-          end
-
-          private
-
-          def normal_request? context
-            method = context.request.request_method
-            context.request.static_request? || method.nil? || STANDARD_METHODS.include?(method.upcase)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,101 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# This could be useful for making patterns maybe?
-# https://github.com/cr0hn/nosqlinjection_wordlists
-# https://www.owasp.org/index.php/Testing_for_NoSQL_injection
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect NoSQL Injection rule.
-        class NoSqli < Contrast::Agent::Protect::Rule::BaseService
-          NAME = 'nosql-injection'
-          BLOCK_MESSAGE = 'NoSQLi rule triggered. Response blocked.'
-
-          def name
-            NAME
-          end
-
-          def block_message
-            BLOCK_MESSAGE
-          end
-
-          def infilter context, database, query_string
-            return nil unless infilter?(context)
-
-            result = find_attacker(context, query_string, database: database)
-            return nil unless result
-
-            append_to_activity(context, result)
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
-          end
-
-          def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
-            return result if mode == :NO_ACTION || mode == :PERMIT
-
-            attack_string = input_analysis_result.value
-            regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
-            return nil unless query_string.match?(regexp)
-
-            scanner = select_scanner
-            ss = StringScanner.new(query_string)
-            length = attack_string.length
-            while ss.scan_until(regexp)
-              # the pos of StringScanner is at the end of the regexp (input string),
-              # we need the beginning
-              idx = ss.pos - attack_string.length
-              last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
-              next unless last_boundary && boundary
-
-              kwargs[:start_idx] = idx
-              kwargs[:end_idx] = idx + length
-              kwargs[:boundary_overrun_idx] = boundary
-              kwargs[:input_boundary_idx] = last_boundary
-
-              result ||= build_attack_result(context)
-              update_successful_attack_response(context, input_analysis_result, result, query_string)
-              append_sample(context, input_analysis_result, result, query_string, **kwargs)
-            end
-
-            result
-          end
-
-          protected
-
-          def find_attacker context, potential_attack_string, **kwargs
-            if potential_attack_string
-              # We need the query hash to be a JSON string to match on JSON input attacks
-              begin
-                potential_attack_string = JSON.generate(potential_attack_string).to_s
-              rescue JSON::GeneratorError
-                logger.debug("Error in JSON::generate from input #{ potential_attack_string }")
-              end
-            end
-            super(context, potential_attack_string, **kwargs)
-          end
-
-          def build_sample context, input_analysis_result, candidate_string, **kwargs
-            input = input_analysis_result.value
-
-            sample = build_base_sample(context, input_analysis_result)
-            sample.no_sqli = Contrast::Api::Dtm::NoSqlInjectionDetails.new
-            sample.no_sqli.query = Contrast::Utils::StringUtils.protobuf_safe_string(candidate_string)
-            sample.no_sqli.start_idx = sample.no_sqli.query.index(input).to_i
-            sample.no_sqli.boundary_overrun_idx = sample.no_sqli.start_idx + input.length
-            sample.no_sqli.input_boundary_idx = kwargs[:boundary].to_i
-            sample.no_sqli.input_boundary_idx = kwargs[:last_boundary].to_i
-            sample
-          end
-
-          private
-
-          def select_scanner
-            @_select_scanner ||= Contrast::Agent::Protect::Rule::NoSqli::MongoNoSqlScanner.new
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,101 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_sqli_rule'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect SQL Injection rule.
-        class Sqli < Contrast::Agent::Protect::Rule::BaseService
-          NAME = 'sql-injection'
-          BLOCK_MESSAGE = 'SQLi rule triggered. Response blocked.'
-
-          def name
-            NAME
-          end
-
-          def block_message
-            BLOCK_MESSAGE
-          end
-
-          def infilter context, database, query_string
-            return nil unless infilter?(context)
-
-            result = find_attacker(context, query_string, database: database)
-            return nil unless result
-
-            append_to_activity(context, result)
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
-          end
-
-          def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
-            attack_string = input_analysis_result.value
-            regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
-
-            return nil unless query_string.match?(regexp)
-
-            database = kwargs[:database]
-            scanner = select_scanner(database)
-
-            ss = StringScanner.new(query_string)
-            length = attack_string.length
-            while ss.scan_until(regexp)
-              # the pos of StringScanner is at the end of the regexp (input string),
-              # we need the beginning
-              idx = ss.pos - attack_string.length
-              last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
-              next unless last_boundary && boundary
-
-              input_analysis_result.attack_count = input_analysis_result.attack_count + 1
-
-              kwargs[:start_idx] = idx
-              kwargs[:end_idx] = idx + length
-              kwargs[:boundary_overrun_idx] = boundary
-              kwargs[:input_boundary_idx] = last_boundary
-
-              result ||= build_attack_result(context)
-              update_successful_attack_response(context, input_analysis_result, result, query_string)
-              append_sample(context, input_analysis_result, result, query_string, **kwargs)
-            end
-
-            result
-          end
-
-          protected
-
-          def build_sample context, input_analysis_result, candidate_string, **kwargs
-            input = input_analysis_result.value
-
-            sample = build_base_sample(context, input_analysis_result)
-            sample.sqli = Contrast::Api::Dtm::SqlInjectionDetails.new
-            sample.sqli.query = Contrast::Utils::StringUtils.protobuf_safe_string(candidate_string)
-            sample.sqli.start_idx = sample.sqli.query.index(input).to_i
-            sample.sqli.end_idx = sample.sqli.start_idx + input.length
-            sample.sqli.boundary_overrun_idx = kwargs[:boundary].to_i
-            sample.sqli.input_boundary_idx = kwargs[:last_boundary].to_i
-            sample
-          end
-
-          private
-
-          def select_scanner database
-            @sql_scanners ||= {
-                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_MYSQL =>
-                    Contrast::Agent::Protect::Rule::Sqli::MysqlSqlScanner.new,
-                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_PG =>
-                    Contrast::Agent::Protect::Rule::Sqli::PostgresSqlScanner.new,
-                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_SQLITE =>
-                    Contrast::Agent::Protect::Rule::Sqli::SqliteSqlScanner.new
-            }.cs__freeze
-
-            @default_sql_scanner ||= Contrast::Agent::Protect::Rule::Sqli::DefaultSqlScanner.new
-            @sql_scanners[database.to_s] || @default_sql_scanner
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Unsafe File Upload rule.
-        class UnsafeFileUpload < Contrast::Agent::Protect::Rule::BaseService
-          NAME = 'unsafe-file-upload'
-          BLOCK_MESSAGE = 'Unsafe file upload rule triggered. Request blocked.'
-
-          def name
-            NAME
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Cross-Site Scripting rule.
-        class Xss < Contrast::Agent::Protect::Rule::BaseService
-          NAME = 'reflected-xss'
-          BLOCK_MESSAGE = 'XSS rule triggered. Response blocked.'
-
-          def name
-            NAME
-          end
-
-          def stream_safe?
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,120 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/timer'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # Implementation of the XXE Protect Rule used to evaluate XML calls for exploit
-        # of unsafe external entity resolution.
-        class Xxe < Contrast::Agent::Protect::Rule::Base
-          NAME = 'xxe'
-          EXPLOIT_CHARACTERS = Contrast::Utils::ObjectShare::EMPTY_ARRAY
-          BLOCK_MESSAGE = 'XXE rule triggered. Response blocked.'
-          EXTERNAL_ENTITY_PATTERN = /<!ENTITY\s+[a-zA-Z0-f]+\s+(?:SYSTEM|PUBLIC)\s+(.*?)>/.cs__freeze
-
-          def name
-            NAME
-          end
-
-          def infilter context, framework, xml
-            result = find_attacker(context, xml, framework: framework)
-            return nil unless result
-
-            append_to_activity(context, result)
-            return unless blocked?
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE)
-          end
-
-          protected
-
-          def find_attacker context, xml, **kwargs
-            return nil unless xml
-            return nil if protect_excluded_by_code?
-
-            logger.debug("checking: #{ name } in '#{ kwargs[:framework] }'")
-
-            xxe_details, last_idx = build_details(xml)
-            return nil unless xxe_details
-
-            # For our definition, the prolog goes from the start of the XML
-            # string to the end of the last entity declaration.
-            xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx])
-            ia_result = build_evaluation(xxe_details.xml)
-            result = build_attack_with_match(
-                context,
-                ia_result,
-                nil,
-                nil,
-                details: xxe_details)
-
-            result
-          end
-
-          def build_details xml, _evaluation = nil
-            last_idx = 0
-            ss = StringScanner.new(xml)
-            while ss.scan_until(EXTERNAL_ENTITY_PATTERN)
-              last_idx = ss.pos
-              entity_wrapper = Contrast::Agent::Protect::Rule::Xxe::EntityWrapper.new(ss.matched)
-              next unless entity_wrapper.external_entity?
-
-              xxe_details ||= Contrast::Api::Dtm::XxeDetails.new
-              xxe_details.declared_entities << build_match(ss)
-              xxe_details.entities_resolved << build_wrapper(entity_wrapper)
-            end
-            [xxe_details, last_idx]
-          end
-
-          def build_sample context, ia_result, _url, **kwargs
-            sample = build_base_sample(context, ia_result)
-            sample.xxe = kwargs[:details]
-            sample
-          end
-
-          INPUT_NAME = 'XML Prolog'
-          def build_user_input ia_result
-            input = Contrast::Api::Dtm::UserInput.new
-            input.key = INPUT_NAME
-            input.input_type = :UNKNOWN
-            input.document_type = :XML
-            input.value = ia_result.value
-            input
-          end
-
-          private
-
-          # We know that this attack happened, so the result is always matched
-          # and the level is always critical. Only variable is the XML value
-          # supplied by the attacker.
-          def build_evaluation xml
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.rule_id = name
-            ia_result.input_type = :UNKNOWN
-            ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(xml)
-            ia_result
-          end
-
-          def build_match string_scanner
-            match = Contrast::Api::Dtm::XxeMatch.new
-            match.end_idx = string_scanner.pos.to_i
-            match.start_idx = match.end_idx - string_scanner.matched_size
-            match
-          end
-
-          def build_wrapper entity_wrapper
-            wrapper = Contrast::Api::Dtm::XxeWrapper.new
-            wrapper.system_id = Contrast::Utils::StringUtils.protobuf_safe_string(
-                entity_wrapper.system_id)
-            wrapper.public_id = Contrast::Utils::StringUtils.protobuf_safe_string(
-                entity_wrapper.public_id)
-            wrapper
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/railtie.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/job_servers_running'
-
-module Contrast
-  module Agent
-    # A Railtie to allow for the automatic hooking of the Agent into a Rails
-    # application.
-    class Railtie < Rails::Railtie
-      include Contrast::Components::Interface
-      access_component :agent, :app_context, :logging
-
-      initializer 'Contrast Ruby Agent Initializer' do |app|
-        if defined?(Rails) && defined?(Rails.logger)
-          Rails.logger.debug('In railtie ::')
-          Rails.logger.debug(app.middleware.inspect)
-        end
-
-        # TODO: RUBY-564 This logic is not specific to Rails and should be used more broadly
-        # with all web frameworks. Move this check to be a part of our new initialization
-        # routine.
-        if APP_CONTEXT.instrument_middleware_stack?
-          AGENT.insert_middleware(app)
-        else
-          Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.')
-          logger.debug(nil, "Disabling Contrast for process #{ Process.pid }")
-        end
-      end
-
-      rake_tasks do
-        load 'contrast/tasks/service.rb'
-      end
-    end
-  end
-end