contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reaction_processor.rb

@@ -1,47 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/disable_reaction'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # Because communication between the Agent/Service and TeamServer can only
-    # be initiated by outbound connections from the Agent/Service, we must
-    # provide a mechanism for the TeamServer to direct the Agent to take a
-    # specific action. This action is referred to as a Reaction. This class is
-    # how we handle those Reaction messages.
-    class ReactionProcessor
-      include Contrast::Components::Interface
-      access_component :logging
-
-      # Process the given Reactions from the application settings based on what
-      # TeamServer has indicated. Each Reaction will result in a log message
-      # and, optionally, an action.
-      #
-      # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
-      #   those settings which the Service has relayed from TeamServer.
-      def self.process application_settings
-        return nil unless application_settings&.reactions&.any?
-
-        application_settings.reactions.each do |reaction|
-          logger.debug(nil, "Received the following reaction: #{ reaction.operation }")
-
-          # the enums are all uppercase, we need to downcase them before attempting to log
-          level = reaction.log_level.nil? ? :error : reaction.log_level.downcase
-
-          logger.with_level(nil, reaction.message, level) if reaction.message
-
-          case reaction.operation
-          when :DISABLE
-            Contrast::Agent::DisableReaction.run reaction, level
-          when :NOOP # rubocop:disable Lint/EmptyWhen
-            # NOOP
-          else
-            logger.warn(nil, "ReactionProcessor received a reaction with an unknown operation: #{ reaction.operation }")
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/request.rb

@@ -1,475 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/comment_range'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # This class is the Contrast representation of the Rack::Request object. It
-    # provides access to the original Rack::Request object as well as extracts
-    # data in a format that the Agent expects, caching those transformations in
-    # order to avoid repeatedly creating Strings & thrashing GC.
-    class Request
-      include Contrast::Components::Interface
-      access_component :logging, :scope
-
-      extend Forwardable
-
-      INNER_REST_TOKEN = %r{/[\d]+/}.cs__freeze
-      LAST_REST_TOKEN = %r{/[\d]+$}.cs__freeze
-      INNER_NUMBER_MARKER = '/{n}/'
-      LAST_NUMBER_MARKER = '/{n}'
-      OMITTED_BODY = '{{body-omitted-by-contrast}}'
-
-      attr_reader :rack_request
-
-      def_delegators :@rack_request,
-                     :env,
-                     :query_string,
-                     :user_agent,
-                     :path,
-                     :base_url
-
-      # receiver is memoized because it is the address/host/port of the server, once we
-      # resolve this for the first time, it shouldn't change
-      def self.receiver
-        @_receiver ||= build_receiver
-      end
-
-      def initialize rack_request
-        @rack_request = rack_request
-      end
-
-      ACCEPT = 'ACCEPT'
-      def accept_headers
-        accepts = Array(normalized_request_headers[ACCEPT])
-        accepts.any? ? accepts : nil
-      end
-
-      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
-      WILDCARD = '*/*'
-      # Utility method for checking if a request is for a static resource.
-      # @return [Boolean] true, if the request is for a well-known static
-      #  type, like the following, and false otherwise: .js, .css, .jpg,
-      # .gif, .png, .ico
-      def static_request?
-        return true if trimmed_uri&.match?(STATIC_SUFFIXES)
-
-        accepts = accept_headers
-        if accepts
-          return false if accepts[0].to_s.start_with?(WILDCARD)
-          return true if media_content_type?(accepts[0])
-        end
-
-        false
-      end
-
-      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
-      def media_content_type? str
-        str = str.to_s
-        str.start_with?(*MEDIA_TYPE_MARKERS)
-      end
-
-      def trimmed_uri
-        @_trimmed_uri ||= begin
-          raise ArgumentError, 'url was nil when attempting to trim' unless uri
-
-          trimmed = uri.split(Contrast::Utils::ObjectShare::SEMICOLON).first # remove ;jsessionid
-          trimmed.split(Contrast::Utils::ObjectShare::QUESTION_MARK).first # remove ?query_string=
-        end
-      end
-
-      # Returns a normalized form of the URI. In "normal" URIs
-      # this will return an unchanged String, but in REST-y
-      # URIs this will normalize the digit path tokens, e.g.:
-      #
-      # /accounts/5/view
-      # ...becomes:
-      # /accounts/{n}/view
-      #
-      # Should also handle the ;jsessionid.
-      def normalized_uri
-        @_normalized_uri ||= begin
-          uri = trimmed_uri
-          uri = uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER) # replace interior tokens
-          uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER) # replace last token
-        end
-      end
-
-      UNKNOWN_REQUEST_METHOD = 'UNKNOWN'
-
-      def request_method
-        rack_request.get_header(Rack::REQUEST_METHOD)
-      rescue StandardError => e
-        logger.warn("Unable to extract request method: #{ e }")
-        UNKNOWN_REQUEST_METHOD
-      end
-
-      def document_type_from_header
-        case content_type
-        when /xml/i
-          :XML
-        when /json/i
-          :JSON
-        when /html/i
-          :NORMAL
-        end
-      end
-
-      def document_type
-        @_document_type ||= begin
-          type = document_type_from_header
-          if type
-            type
-          elsif request_body_str.start_with?('<?xml')
-            :XML
-          elsif request_body_str.match?(/\s*[{\[]/)
-            :JSON
-          else
-            :NORMAL
-          end
-        end
-      end
-
-      def request_headers
-        @_request_headers ||= begin
-          with_contrast_scope do
-            headers = header_pairs(env).each_with_object({}) do |pair, h|
-              h[pair[0]] = pair[1]
-            end
-            headers
-          end
-        end
-      end
-
-      # Header keys upcased and any underscores replaced with dashes
-      def normalized_request_headers
-        @_normalized_request_headers ||= begin
-          hash = {}
-          request_headers.each_pair do |header_name, header_value|
-            hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-          end
-          hash
-        end
-      end
-
-      def header_value key
-        normalized_request_headers[Contrast::Utils::StringUtils.normalized_key(key)]
-      end
-
-      # Return a flattened hash of params with realized paths for keys, in
-      # addition to a separate, valueless, entry for each nest key.
-      # See RUBY-621 for more details.
-      # { key : { nested_key : ['x','y','z' ] } }
-      # becomes
-      # {
-      #   key[nested_key][0] : 'x'
-      #   key[nested_key][1] : 'y'
-      #   key[nested_key][2] : 'z'
-      #   key :                ''
-      #   nested_key :         ''
-      # }
-      def normalize_params val, prefix: nil
-        # In non-recursive invocations, val should always be a Hash
-        # (rather than breaking this out into two methods)
-        case val
-        when Tempfile
-          { prefix => Contrast::Utils::StringUtils.force_utf8(val.path) }
-        when Hash
-          res = val.each_with_object({}) do |(k, v), hash|
-            k = Contrast::Utils::StringUtils.force_utf8(k)
-            nested_prefix = prefix.nil? ? k : "#{ prefix }[#{ k }]"
-            hash[k] = Contrast::Utils::ObjectShare::EMPTY_STRING
-            hash.merge! normalize_params(v, prefix: nested_prefix)
-          end
-          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
-          res
-        when Enumerable
-          res = val.each_with_index.each_with_object({}) do |(v, i), hash|
-            hash.merge! normalize_params(v, prefix: "#{ prefix }[#{ i }]")
-          end
-          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
-          res
-        else
-          { prefix => Contrast::Utils::StringUtils.force_utf8(val) }
-        end
-      end
-
-      def request_body
-        # Memoize a flag indicating whether we've tried to read the body or not
-        # (can't use body because it might be nil)
-        @_request_body_read ||= begin
-          body = @rack_request.body
-          if defined?(Rack::Multipart)
-            if defined?(Rack::Multipart::UploadedFile) && body.is_a?(Rack::Multipart::UploadedFile)
-              logger.debug("not parsing uploaded file body :: #{ body.original_filename }::#{ body.content_type }")
-              @_request_body = nil
-            else
-              logger.debug("parsing body from request :: #{ body.cs__class.cs__name }")
-              @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body), logger)
-            end
-          else
-            logger.debug('Rack before 1.3.x does not support Rack::Multipart')
-            @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body), logger)
-          end
-
-          true
-        end
-
-        # Return memoized body (which might be nil)
-        @_request_body
-      end
-
-      def request_body_str
-        request_body.to_s || Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
-
-      # This will become to_protobuf
-      # Expectation is that all data from a previous phase will be populated
-      # before the subsequent one begins
-      def dtm
-        @_dtm ||= begin
-          with_contrast_scope do
-            http_request = Contrast::Api::Dtm::HttpRequest.new
-            http_request.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
-            http_request.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
-
-            append_receiver(http_request)
-            append_connection(http_request)
-            append_params(http_request)
-            append_headers(http_request)
-            append_body(http_request)
-
-            http_request
-          end
-        end
-      end
-
-      def append_receiver http_request
-        r = cs__class.receiver
-        r.port = port.to_i if port
-        http_request.receiver = r unless r.nil?
-      end
-
-      def append_connection http_request
-        http_request.sender = Contrast::Api::Dtm::Address.new
-        http_request.sender.ip = Contrast::Utils::StringUtils.force_utf8(ip)
-        http_request.protocol = Contrast::Utils::StringUtils.force_utf8(scheme)
-        http_request.version = '1.1' # currently not in rack request; hard-coding
-        http_request.method = Contrast::Utils::StringUtils.force_utf8(request_method)
-        http_request.raw = Contrast::Utils::StringUtils.force_utf8(@rack_request.path_info)
-        http_request.parsed_connection = false
-      end
-
-      def append_params http_request
-        parameters.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          params = http_request.normalized_request_params
-          params[key] = Contrast::Api::Dtm::Pair.new unless params[key].is_a?(Contrast::Api::Dtm::Pair)
-          params[key].key = key
-          params[key].values << val
-        end
-      end
-
-      def append_headers http_request
-        request_headers.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.request_headers[key] = val
-        end
-
-        http_request.parsed_request_headers = true
-
-        normalized_request_headers.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.normalized_request_headers[key] ||= Contrast::Api::Dtm::Pair.new
-          http_request.normalized_request_headers[key].key = key
-          http_request.normalized_request_headers[key].values << val
-        end
-
-        request_cookies.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.normalized_cookies[key] ||= Contrast::Api::Dtm::Pair.new
-          http_request.normalized_cookies[key].key = key
-          http_request.normalized_cookies[key].values << val
-        end
-      end
-
-      def append_body http_request
-        http_request.document_type = Contrast::Utils::StringUtils.force_utf8(document_type)
-
-        http_request.request_body = if omit_body?
-                                      OMITTED_BODY
-                                    else
-                                      Contrast::Utils::StringUtils.force_utf8(request_body)
-                                    end
-        return if file_names.empty?
-
-        file_names.each do |name, filename|
-          pair = Contrast::Api::Dtm::SimplePair.new
-          pair.key = Contrast::Utils::StringUtils.force_utf8(name)
-          pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
-          http_request.multipart_headers << pair
-        end
-      end
-
-      def omit_body?
-        return true if Contrast::Agent::FeatureState.instance.omit_body?
-        return false if document_type == :XML
-        return false if document_type == :JSON
-
-        content_type&.include?('multipart/form-data')
-      end
-
-      def self.build_receiver
-        address = Contrast::Api::Dtm::Address.new
-        address.host = 'localhost'
-        address.ip = '127.0.0.1'
-        begin
-          Timeout.timeout(1) do
-            address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-            address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-          end
-        rescue Timeout::Error
-          logger.warn(nil, "Timeout resolving host or ip in #{ address }")
-        rescue StandardError => e
-          logger.warn(e, "Error resolving address for #{ address }")
-        end
-        address
-      end
-
-      # Memoized Rack Request Values
-      def ip
-        @_ip ||= @rack_request.ip
-      end
-
-      def scheme
-        @_scheme ||= @rack_request.scheme
-      end
-
-      def port
-        @_port ||= @rack_request.port
-      end
-
-      def uri
-        @_uri ||= @rack_request.path
-      end
-
-      def url
-        @_url ||= @rack_request.url
-      end
-
-      def content_type
-        @_content_type ||= @rack_request.content_type
-      end
-
-      def request_cookies
-        @_request_cookies ||= @rack_request.cookies
-      end
-
-      def parameters
-        @_parameters ||= with_contrast_scope { normalize_params(@rack_request.params) }
-      end
-
-      # End of Rack Request memoized values
-
-      def file_names
-        @_file_names ||= begin
-                           names = {}
-                           parsed_data = Rack::Multipart.parse_multipart(@rack_request.env)
-                           traverse_parsed_multipart(parsed_data, names)
-                         rescue StandardError => _e
-                           logger.warn('Unable to parse multipart request!')
-                           {}
-                         end
-      end
-
-      def hash_id
-        @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
-      end
-
-      # we just need to map length to a repeatable value
-      # unlike Java, we hash with strings, so we'll use single character
-      # strings for our purposes.
-      CHARS = %w[a b c d e f g].cs__freeze
-      def normalized_length_header chr
-        chr = chr.to_s
-        tmp = CHARS[Math.log10(chr.length).to_i] if chr
-        tmp ||= CHARS[6]
-        tmp
-      end
-
-      private
-
-      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
-
-      def header_pairs env
-        selected = env.select do |k, _v|
-          k.to_s.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
-        end
-        selected.map do |k, v|
-          name = k.to_s.sub(HTTP_PREFIX, Contrast::Utils::ObjectShare::EMPTY_STRING)
-          [name, v]
-        end
-      end
-
-      def read_body body
-        return body if body.is_a?(String)
-
-        begin
-          can_rewind = Contrast::Utils::DuckUtils.quacks_to?(body, :rewind)
-          # if we are after a middleware that failed to rewind
-          body.rewind if can_rewind
-          body.read
-        rescue StandardError => e
-          logger.error("Error in attempt to read body :: #{ e.message }")
-          logger.debug(e.backtrace.join(Contrast::Utils::ObjectShare::NEW_LINE))
-          body.to_s
-        ensure
-          # be a good citizen and rewind
-          body.rewind if can_rewind
-        end
-      end
-
-      def traverse_parsed_multipart multipart_data, current_names
-        return current_names unless multipart_data
-
-        multipart_data.each_value do |data_value|
-          next unless data_value.is_a?(Hash)
-
-          tempfile = data_value[:tempfile]
-          if tempfile.nil?
-            traverse_parsed_multipart(data_value, current_names)
-          else
-            name = data_value[:name].to_s
-            file_name = data_value[:filename].to_s
-            current_names[name] = file_name
-          end
-        end
-        current_names
-      end
-    end
-  end
-end