contrast-agent 4.13.0 → 5.0.0

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -18,7 +18,7 @@ module Contrast
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
             def self.valid? _patcher, _object, _ret, _args
               content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
-              return true unless content_type
+              return false unless content_type
 
               content_type = content_type.downcase
               SAFE_CONTENT_TYPES.none? { |safe_type| content_type.index(safe_type) }

data/lib/contrast/agent/assess/properties.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'base64'

data/lib/contrast/agent/assess/property/evented.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -18,22 +18,15 @@ module Contrast
 
           # Create a new event and add it to the event set.
           #
-          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
-          #   the node that governs this event.
-          # @param tagged [Object] the Target to which this event pertains.
-          # @param object [Object] the Object on which the method was invoked
-          # @param ret [Object] the Return of the invoked method
-          # @param args [Array<Object>] the Arguments with which the method
-          #   was invoked
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
           # @param source_type [String] the type of this source, from the
           #   source_node, or a KEY_TYPE if invoked for a map
           # @param source_name [String, nil] the name of this source, i.e.
           #   the key used to accessed if from a map or nil if a type like
           #   BODY
-          def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            @event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args,
-                                                                         source_type, source_name)
-            report_sources(tagged, event)
+          def build_event event_data, source_type = nil, source_name = nil
+            @event = Contrast::Agent::Assess::Events::EventFactory.build(event_data, source_type, source_name)
+            report_sources(event_data.tagged, @event)
           end
 
           private
@@ -49,6 +42,11 @@ module Contrast
             return unless event.source_type
             return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
 
+            append_to_dtm current_request, event
+            append_to_ruby_object current_request, event
+          end
+
+          def append_to_dtm current_request, event
             if current_request.observed_route.sources.any? do |source|
                  source.type == event.forced_source_type &&
                        source.name == event.forced_source_name # rubocop:disable Security/Module/Name
@@ -62,6 +60,21 @@ module Contrast
 
             current_request.observed_route.sources << event_source_dtm
           end
+
+          def append_to_ruby_object current_request, event
+            if current_request.new_observed_route.sources.any? do |source|
+              source.type == event.forced_source_type &&
+                    source.name == event.forced_source_name # rubocop:disable Security/Module/Name
+            end
+
+              return
+            end
+
+            event_source = event.build_event_source
+            return unless event_source
+
+            current_request.new_observed_route.sources << event_source
+          end
         end
       end
     end

data/lib/contrast/agent/assess/property/tagged.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tag'
@@ -24,29 +24,6 @@ module Contrast
             instance_variable_defined?(:@_tags) && tags.any?
           end
 
-          # Is the given tag present?
-          # Used in testing, so found by `be_tagged`, if you're grepping for it
-          #
-          # @param label [Symbol] the tag to check for
-          # @return [Boolean]
-          def tagged? label
-            tracked? && tags.key?(label)
-          end
-
-          # Similar to #tracked?, but limited to a given range.
-          #
-          # @param start [Integer] the inclusive start index to check.
-          # @param finish [Integer] the exclusive end index to check.
-          # @return [Boolean]
-          def any_tags_between? start, finish
-            return false unless tracked?
-
-            tags.each_value do |tag_array|
-              return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
-            end
-            false
-          end
-
           # Remove all tags within the given ranges.
           # This does not delete an entire tag if part of that tag is
           # outside this range, meaning we may reduce sizes of tags
@@ -102,6 +79,8 @@ module Contrast
           end
 
           # Remove the tag ranges covering the given range
+          # and appends any trailing value that might
+          # exist after removal of range
           def remove_tags range
             return unless tracked?
 
@@ -112,19 +91,7 @@ module Contrast
               value.each do |tag|
                 comparison = tag.compare_range(range.begin, range.end)
                 # ABOVE and BELOW are not affected by this check
-                case comparison
-                when Contrast::Agent::Assess::Tag::LOW_SPAN
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::WITHIN
-                  remove << tag
-                when Contrast::Agent::Assess::Tag::WITHOUT
-                  new_tag = tag.clone
-                  new_tag.update_start(range.end)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                  tag.update_start(range.end)
-                end
+                tags_remove_comparison comparison, tag, remove, add, range
               end
               value.delete_if { |tag| remove.include?(tag) }
               Contrast::Utils::TagUtil.ordered_merge(value, add)
@@ -133,6 +100,29 @@ module Contrast
             full_delete.each { |key| tags.delete(key) }
           end
 
+          # This method is for the tags comparison
+          # the idea is to move the whole case here
+          # @param comparison [String] indicates type of removal is to occur
+          # @param tag Contrast::Agent::Assess::Tag
+          # @param remove [String] holds removed Tag if exists
+          # @param add [String] holds trailing Tag if exists
+          # @param range [Range] start and stop for idx for removal
+          def tags_remove_comparison comparison, tag, remove, add, range
+            case comparison
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::WITHIN
+              remove << tag
+            when Contrast::Agent::Assess::Tag::WITHOUT
+              new_tag = tag.clone
+              new_tag.update_start(range.end)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN
+              tag.update_start(range.end)
+            end
+          end
+
           # Shift the tag ranges covering the given range
           # We assume this is for a deletion, meaning we
           # have to move tags to the left
@@ -176,32 +166,36 @@ module Contrast
                 comparison = tag.compare_range(range.begin, range.end)
                 length = range.end - range.begin
                 # BELOW is not affected by this check
-                case comparison
-                  # part of the tag is being inserted on
-                when Contrast::Agent::Assess::Tag::LOW_SPAN
-                  new_tag = tag.clone
-                  new_tag.update_start(range.begin)
-                  new_tag.shift(length)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                  # the tag exists in the inserted range. it is partially shifted
-                when Contrast::Agent::Assess::Tag::WITHIN
-                  tag.shift(length)
-                  # the tag spans the range. leave the part below alone
-                when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
-                  new_tag = tag.clone
-                  new_tag.update_start(range.begin)
-                  new_tag.shift(length)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
-                  tag.shift(length)
-                end
+                shift_tags_comparison comparison, add, tag, length, range
               end
               Contrast::Utils::TagUtil.ordered_merge(value, add)
             end
           end
 
+          def shift_tags_comparison comparison, add, tag, length, range
+            case comparison
+              # part of the tag is being inserted on
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+              # the tag exists in the inserted range. it is partially shifted
+            when Contrast::Agent::Assess::Tag::WITHIN
+              tag.shift(length)
+              # the tag spans the range. leave the part below alone
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
+              tag.shift(length)
+            end
+          end
+
           private
 
           # Because of the auto-fill thing, we should not allow direct access to

data/lib/contrast/agent/assess/property/updated.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/duck_utils'

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -95,24 +95,6 @@ module Contrast
 
               children[1] == :bytes
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a byte array, or at least an array of numbers, it
-            # passes for this rule
-            def value_type_passes? value
-              return false unless value.is_a?(Array) && value.any?
-
-              value.each do |byte|
-                return false unless byte.is_a?(Integer)
-              end
-              true
-            end
-
-            # There isn't a filter for the byte value. The check is not evaluated
-            # for this rule
-            def value_passes? _value
-              true
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -71,18 +71,6 @@ module Contrast
             def redacted_marker
               REDACTED_MARKER
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a string, it passes for this rule
-            def value_type_passes? value
-              value.is_a?(String)
-            end
-
-            # If the value probably isn't a property name, it passes for this
-            # rule
-            def value_passes? value
-              !probably_property_name?(value)
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'
 require 'contrast/components/logger'
 require 'contrast/extension/module'
+require 'contrast/agent/reporting/report'
 
 module Contrast
   module Agent
@@ -24,52 +25,6 @@ module Contrast
               !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
             end
 
-            # TODO: RUBY-1014 - remove `#analyze`
-            COMMON_CONSTANTS = %i[CONTRAST_ASSESS_POLICY_STATUS VERSION].cs__freeze
-            def analyze clazz
-              return if disabled?
-
-              # we only want the constants explicitly defined in this class, not
-              # those of its ancestor(s)
-              constants = clazz.cs__constants(false)
-
-              # if there are no constants, let's just leave
-              return unless constants&.any?
-
-              constants.each do |constant|
-                next if COMMON_CONSTANTS.include?(constant)
-
-                # if this class autoloads its constant, get the hell away from it
-                # I mean it! Don't even think about it.
-                #
-                # Autoload means this constant (usually [always?] a class or
-                # module) won't be required until something in the application
-                # tries to load it. We CANNOT be that thing. We'll just have to
-                # wait until it's loaded, at which point we'll be handed it
-                # again.
-                next if clazz.cs__autoload?(constant)
-
-                # constant comes to us as a symbol. that sucks. we need to do
-                # some string methods on it, so stringify it.
-                constant_string = constant.to_s
-
-                # if this is another class or a module, move on
-                next unless constant_name?(constant_string)
-
-                next unless name_passes?(constant_string)
-
-                value = clazz.cs__const_get(constant, false)
-
-                # if the constant isn't holding a string, skip it
-                next unless value_type_passes?(value)
-
-                # if it looks like a placeholder / pointer to a config, skip it
-                next unless value_passes?(value)
-
-                build_finding(clazz, constant_string)
-              end
-            end
-
             # Parse the file pertaining to the given TracePoint to walk its AST
             # to determine if a Constant is hardcoded. For our purposes, this
             # hard coding means directly set rather than as an interpolated
@@ -91,14 +46,6 @@ module Contrast
               logger.error('Unable to parse AST for hardcoded keys', e, module: trace_point.self)
             end
 
-            # Constants can be variable or classes defined in the given
-            # class. We ONLY want the variables, which should be defined in
-            # the MACRO_CASE (upper case & underscore format)
-            CONSTANT_NAME_PATTERN = /^[A-Z_]+$/.cs__freeze
-            def constant_name? constant
-              constant.match?(CONSTANT_NAME_PATTERN)
-            end
-
             # The name of the field
             CONSTANT_NAME_KEY = 'name'
             # The code line, recreated, with the password obfuscated
@@ -138,7 +85,11 @@ module Contrast
               # sort. We leave it to each rule to properly handle these nodes.
               return unless value_node_passes?(value)
 
-              build_finding(mod, name)
+              if Contrast::Agent::Reporter.enabled?
+                new_finding_and_reporting mod, name
+              else # TODO: RUBY-1438 -- remove
+                build_finding mod, name
+              end
             end
 
             # Constants can be set as frozen directly. We need to account for
@@ -161,6 +112,14 @@ module Contrast
             def build_finding clazz, constant_string
               class_name = clazz.cs__name
 
+              finding = assign_finding class_name, constant_string
+              Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
+            rescue StandardError => e
+              logger.error('Unable to build a finding for Hardcoded Rule', e)
+              nil
+            end
+
+            def assign_finding class_name, constant_string
               finding = Contrast::Api::Dtm::Finding.new
               finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(rule_id)
               finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
@@ -173,10 +132,33 @@ module Contrast
               hash = Contrast::Utils::HashDigest.generate_class_scanning_hash(finding)
               finding.hash_code = Contrast::Utils::StringUtils.protobuf_safe_string(hash)
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-              Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding)
-            rescue StandardError => e
-              logger.error('Unable to build a finding for Hardcoded Rule', e)
-              nil
+              finding
+            end
+
+            def new_finding_and_reporting clazz, constant_string
+              return unless Contrast::Agent::Reporter.enabled?
+
+              # sent to reporter
+              # and add logger message for the report of the preflight
+              new_preflight = Contrast::Agent::Reporting::Preflight.new
+              new_preflight_message = Contrast::Agent::Reporting::PreflightMessage.new
+              new_preflight_message.hash_code = hash
+              new_preflight_message.data = "#{ rule_id },#{ hash }"
+              new_preflight.messages << new_preflight_message
+
+              # extract to new method
+              # here we will generate new type of finding
+              ruby_finding = Contrast::Agent::Reporting::Finding.new rule_id
+              ruby_finding.hash_code = hash
+              ruby_finding.properties[SOURCE_KEY] = clazz.cs__name
+              ruby_finding.properties[CONSTANT_NAME_KEY] = constant_string
+              ruby_finding.properties[CODE_SOURCE_KEY] = constant_string + redacted_marker
+              save_and_report_finding ruby_finding, new_preflight
+            end
+
+            def save_and_report_finding ruby_finding, new_preflight
+              Contrast::Agent::Reporting::ReportingStorage[hash] = ruby_finding
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
             end
           end
         end

data/lib/contrast/agent/assess/rule/provider.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/rule/response/autocomplete_rule.rb

@@ -0,0 +1,130 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the body contains a form which
+          # incorrectly sets the autocomplete attribute.
+          class Autocomplete < BaseRule
+            def rule_id
+              'autocomplete-missing'
+            end
+
+            protected
+
+            HTML_PROP = 'html'.cs__freeze
+            START_PROP = 'start'.cs__freeze
+            END_PROP = 'end'.cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && body?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              body = response.body
+              forms = forms(body)
+              forms.each do |form|
+                # Because TeamServer will reject any subsequent form on the same page due to deduplication, we can
+                # skip out on the first violation.
+                return form if autocomplete?(form[HTML_PROP])
+              end
+              nil
+            end
+
+            # Find the forms in this body, if any, so as to determine if they violate this rule.
+            #
+            # @param body [String]
+            # @return [Array<Hash>] the forms of this body, as well as their start and end indexes.
+            def forms body
+              forms = []
+              body_start = 0
+              # The instance of "<form" in the body may be a form. Turn them into chunks to check.
+              potential_forms = body.split(form_start)
+              potential_forms.each do |potential_form|
+                # We can consider this a form if the next character is one of whitespace of form tag closing
+                # characters.
+                next unless potential_form
+                next unless form_openings.any? { |opening| potential_form.start_with?(opening) }
+
+                body_start = body.index(form_start, body_start)
+                next unless body_start
+
+                form_stop = potential_form.index('>').to_i
+                next unless form_stop
+
+                body_close = body_start + 6 + form_stop
+                forms << capture(body, body_start, body_close, form_stop)
+                body_start = body_close
+              end
+              forms
+            end
+
+            def form_start
+              /<form/i
+            end
+
+            def form_openings
+              [' ', "\n", "\r", "\t", '>']
+            end
+
+            def off_values
+              [/"off"/, /'off'/, /off /, /off>/]
+            end
+
+            # Determine if the given form does not have a valid autocomplete tag. Because autocompletion is on by
+            # default, the form must both have the value and set it to being disabled to not autocomplete.
+            #
+            # @param form [String] the form tag
+            # @return [Boolean]
+            def autocomplete? form
+              idx = form =~ /autocomplete=/i
+              return true unless idx
+
+              # Adjust for the length of 'autocomplete='
+              idx += 13
+              off_values.each do |off_value|
+                return false if (form =~ off_value) == idx
+              end
+              true
+            end
+
+            # Capture the information needed to build the properties of this finding by parsing out from the body
+            #
+            # @param body [String] the entire HTTP Response body
+            # @param body_start [Integer] the start of the range to take from the body
+            # @param body_close [Integer] the end of the range to take from the body
+            # @param form_stop [Integer] the index of the end of the form from its start
+            # @return [Hash]
+            def capture body, body_start, body_close, form_stop
+              form = {}
+              # Capture the 50 characters in front of the form, or up to the start if the form starts before 50.
+              capture_start = body_start < 50 ? 0 : body_start - 50
+              # Start is where the '<form' is in the body
+              # 6 accounts for the characters in the form and the opening char
+              # potential_form.index('>') accounts for finding the rest of the form
+              # 50 accounts for the context to capture beyond
+              capture_close = body_close + 50
+              form[HTML_PROP] = body[capture_start...capture_close]
+              form[START_PROP] = body_start < 50 ? body_start : 50
+              form[END_PROP] = form[START_PROP] + 6 + form_stop
+              form
+            end
+          end
+        end
+      end
+    end
+  end
+end