contrast-agent 4.13.1 → 5.1.0

data/lib/contrast/agent/assess/policy/trigger_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -7,6 +7,8 @@ require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
 require 'contrast/utils/assess/trigger_method_utils'
+require 'contrast/agent/assess/events/event_data'
+require 'contrast/agent/reporting/reporting_utilities/reporting_storage'
 
 module Contrast
   module Agent
@@ -16,7 +18,7 @@ module Contrast
         # Contrast::Agent::Assess::Policy::TriggerNode class. Each such method will call to this module just after
         # invocation in order to determine if the call was done safely. In those cases where it was not, a Finding
         # report is issued to the Service.
-        module TriggerMethod
+        module TriggerMethod # rubocop:disable Metrics/ModuleLength
           extend Contrast::Components::Logger::InstanceMethods
           extend Contrast::Utils::Assess::TriggerMethodUtils
 
@@ -25,6 +27,11 @@ module Contrast
           MINIMUM_FINDING_VERSION = 3
           # The level of TeamServer compliance our traces meet.
           CURRENT_FINDING_VERSION = 4
+          # Rules that always exists outside of Request Context
+          NON_REQUEST_RULES = [
+            'hardcoded-password', # Contrast::Agent::Assess::Rule::Provider::HardcodedPassword.NAME,
+            'hardcoded-key' # Contrast::Agent::Assess::Rule::Provider::HardcodedKey.NAME
+          ].cs__freeze
 
           class << self
             # This is called from within our woven proc. It will be called as if it were inline in the Rack
@@ -38,6 +45,14 @@ module Contrast
             def apply_trigger_rule trigger_node, object, ret, args
               return if trigger_node.nil?
 
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              # return if there is no context and the flag is set to default => false
+              # we need to have request if the flag is default
+              # else proceed, if the flag is true we don't need to check for context we
+              # go as currently.
+              # When outside of a request, only track when the feature is enabled
+              return unless Contrast::ASSESS.non_request_tracking? || context
+
               if trigger_node.sources&.any?
                 trigger_node.sources.each do |marker|
                   source = determine_source(marker, object, ret, args)
@@ -52,6 +67,14 @@ module Contrast
               apply_trigger(trigger_node, source, object, ret, *args)
             end
 
+            def append_to_finding finding, event_data, request
+              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(event_data.policy_node.rule_id)
+              finding.version = determine_compliance_version(finding)
+              append_events(finding, event_data)
+              append_route(finding, request)
+              append_hash(finding, event_data.tagged, request)
+            end
+
             # This converts the source of the finding, and the events leading up to it into a Finding
             #
             # @param trigger_node [Contrast::Agent::Assess::Policy::TriggerNode] the node to direct applying this
@@ -63,21 +86,28 @@ module Contrast
             # @return [Contrast::Api::Dtm::Finding, nil] the Contrast::Api::Dtm::Finding to send to TeamServer or
             #   nil if conditions were not met
             def build_finding trigger_node, source, object, ret, *args
+              content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
+
+              if content_type.nil? && trigger_node.collectable?
+                Contrast::Agent::FINDINGS.collect_finding trigger_node, source, object, ret, *args
+                return
+              end
+
               return unless Contrast::Agent::Assess::Policy::TriggerValidation.valid?(trigger_node, object, ret, args)
 
               request = find_request(source)
               return unless reportable?(request&.env)
 
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(trigger_node.rule_id)
-
-              append_events(finding, trigger_node, source, object, ret, args)
-              append_route(finding, request)
-              append_hash(finding, source, request)
-              finding.version = determine_compliance_version(finding)
-              logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
-                                              rule: trigger_node.rule_id)
-              report_finding(finding, request)
+              if Contrast::Agent::Reporter.enabled?
+                handle_new_finding(trigger_node, source, object, ret, request, *args)
+              else # TODO: RUBY-1438 -- remove
+                finding = Contrast::Api::Dtm::Finding.new
+                event_data = Contrast::Agent::Assess::Events::EventData.new trigger_node, source, object, ret, args
+                append_to_finding finding, event_data, request
+                logger.trace('Finding created', node_id: trigger_node.id, source_id: source.__id__,
+                                                rule: trigger_node.rule_id)
+                report_finding(finding, request)
+              end
             rescue StandardError => e
               logger.error('Unable to build a finding', e, rule: trigger_node.rule_id, node_id: trigger_node.id)
             end
@@ -97,6 +127,8 @@ module Contrast
                 return
               end
 
+              return unless ::Contrast::ASSESS.non_request_tracking? || NON_REQUEST_RULES.include?(finding.rule_id)
+
               activity = Contrast::Api::Dtm::Activity.new
               activity.findings << finding
               if request
@@ -105,11 +137,30 @@ module Contrast
                 logger.debug('Attempted to report finding without request', finding: finding)
               end
 
-              # If we're out of request context, then we need to report this finding ourselves, so we'll send it in the
-              # one-off activity we created.
+              # If we're out of request context, then we need to report this finding ourselves,
+              # so we'll send it in the one-off activity we created.
               Contrast::Agent.messaging_queue.send_event_eventually(activity)
             end
 
+            def handle_new_finding trigger_node, source, object, ret, request, *args
+              # sent to reporter
+              # here we will generate new type of finding
+              ruby_finding = Contrast::Agent::Reporting::Finding.new trigger_node.rule_id
+              ruby_finding.attach_data trigger_node, source, object, ret, request, *args
+              hash_code = Contrast::Utils::HashDigest.generate_event_hash(ruby_finding, source, request)
+              ruby_finding.hash_code = hash_code
+              # save the current finding
+              Contrast::Agent::Reporting::ReportingStorage[hash_code] = ruby_finding
+
+              new_preflight = Contrast::Agent::Reporting::Preflight.new
+              new_preflight_message = Contrast::Agent::Reporting::PreflightMessage.new
+              new_preflight_message.routes << request
+              new_preflight_message.hash_code = hash_code
+              new_preflight_message.data = "#{ trigger_node.rule_id },#{ hash_code }"
+              new_preflight.messages << new_preflight_message
+              Contrast::Agent.reporter&.send_event_immediately(new_preflight)
+            end
+
             private
 
             def settings
@@ -149,10 +200,9 @@ module Contrast
               end
             end
 
-            def append_events finding, trigger_node, source, object, ret, args
-              append_from_source(finding, source)
-              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(trigger_node, source, object, ret,
-                                                                                    args).to_dtm_event
+            def append_events finding, event_data
+              append_from_source(finding, event_data.tagged)
+              finding.events << Contrast::Agent::Assess::Events::EventFactory.build(event_data).to_dtm_event
             end
 
             def append_from_source finding, source

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger/reflected_xss'
@@ -22,6 +22,10 @@ module Contrast
           JSON_RULE_NAME = 'name'
           JSON_CUSTOM_PATCH = 'custom_patch'
 
+          # Our list with rules to be collected and reported back when we have response
+          # from the application. Some rules rely on Content-Type validation.
+          COLLECTABLE_RULES = %w[reflected-xss].cs__freeze
+
           attr_reader :rule_id, :required_tags, :disallowed_tags, :good_value, :bad_value
 
           def initialize trigger_hash = {}, rule_hash = {}
@@ -67,6 +71,10 @@ module Contrast
             :TYPE_METHOD
           end
 
+          def collectable?
+            COLLECTABLE_RULES.include?(rule_id)
+          end
+
           def rule_disabled?
             ::Contrast::ASSESS.rule_disabled?(rule_id)
           end
@@ -160,8 +168,8 @@ module Contrast
             @disallowed_tags << LIMITED_CHARS
             @disallowed_tags << CUSTOM_ENCODED
             @disallowed_tags << CUSTOM_VALIDATED
-            @disallowed_tags << ENCODER_START + loud_name
-            @disallowed_tags << VALIDATOR_START + loud_name
+            @disallowed_tags << (ENCODER_START + loud_name)
+            @disallowed_tags << (VALIDATOR_START + loud_name)
           end
 
           def validate_rule_tags tags
@@ -200,14 +208,14 @@ module Contrast
               satisfied = tags_at.any? && required_tags.all? { |tag| tags_at.any? { |found| found.label == tag } }
               # if this range matches all the required tags and we're already
               # chunking, meaning the previous range matched, do nothing
-              if satisfied && chunking
-                start_range += 1
-                next
-              end
 
               # if we are satisfied and we were not chunking, this represents
               # the start of the next range, so create a new entry.
               if satisfied
+                if chunking
+                  start_range += 1
+                  next
+                end
                 ranges << Contrast::Agent::Assess::Tag.new('required', 0, start_range)
                 chunking = true
                 # if we are chunking and not satisfied, this represents the end

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -18,7 +18,7 @@ module Contrast
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
             def self.valid? _patcher, _object, _ret, _args
               content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
-              return true unless content_type
+              return false unless content_type
 
               content_type = content_type.downcase
               SAFE_CONTENT_TYPES.none? { |safe_type| content_type.index(safe_type) }

data/lib/contrast/agent/assess/properties.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'base64'

data/lib/contrast/agent/assess/property/evented.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/events/event_factory'
@@ -18,22 +18,15 @@ module Contrast
 
           # Create a new event and add it to the event set.
           #
-          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
-          #   the node that governs this event.
-          # @param tagged [Object] the Target to which this event pertains.
-          # @param object [Object] the Object on which the method was invoked
-          # @param ret [Object] the Return of the invoked method
-          # @param args [Array<Object>] the Arguments with which the method
-          #   was invoked
+          # @param event_data [Contrast::Agent::Assess::Events::EventData]
           # @param source_type [String] the type of this source, from the
           #   source_node, or a KEY_TYPE if invoked for a map
           # @param source_name [String, nil] the name of this source, i.e.
           #   the key used to accessed if from a map or nil if a type like
           #   BODY
-          def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
-            @event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args,
-                                                                         source_type, source_name)
-            report_sources(tagged, event)
+          def build_event event_data, source_type = nil, source_name = nil
+            @event = Contrast::Agent::Assess::Events::EventFactory.build(event_data, source_type, source_name)
+            report_sources(event_data.tagged, @event)
           end
 
           private
@@ -49,6 +42,11 @@ module Contrast
             return unless event.source_type
             return unless (current_request = Contrast::Agent::REQUEST_TRACKER.current)
 
+            append_to_dtm current_request, event
+            append_to_ruby_object current_request, event
+          end
+
+          def append_to_dtm current_request, event
             if current_request.observed_route.sources.any? do |source|
                  source.type == event.forced_source_type &&
                        source.name == event.forced_source_name # rubocop:disable Security/Module/Name
@@ -62,6 +60,21 @@ module Contrast
 
             current_request.observed_route.sources << event_source_dtm
           end
+
+          def append_to_ruby_object current_request, event
+            if current_request.new_observed_route.sources.any? do |source|
+              source.type == event.forced_source_type &&
+                    source.name == event.forced_source_name # rubocop:disable Security/Module/Name
+            end
+
+              return
+            end
+
+            event_source = event.build_event_source
+            return unless event_source
+
+            current_request.new_observed_route.sources << event_source
+          end
         end
       end
     end

data/lib/contrast/agent/assess/property/tagged.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tag'
@@ -24,29 +24,6 @@ module Contrast
             instance_variable_defined?(:@_tags) && tags.any?
           end
 
-          # Is the given tag present?
-          # Used in testing, so found by `be_tagged`, if you're grepping for it
-          #
-          # @param label [Symbol] the tag to check for
-          # @return [Boolean]
-          def tagged? label
-            tracked? && tags.key?(label)
-          end
-
-          # Similar to #tracked?, but limited to a given range.
-          #
-          # @param start [Integer] the inclusive start index to check.
-          # @param finish [Integer] the exclusive end index to check.
-          # @return [Boolean]
-          def any_tags_between? start, finish
-            return false unless tracked?
-
-            tags.each_value do |tag_array|
-              return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
-            end
-            false
-          end
-
           # Remove all tags within the given ranges.
           # This does not delete an entire tag if part of that tag is
           # outside this range, meaning we may reduce sizes of tags
@@ -102,6 +79,8 @@ module Contrast
           end
 
           # Remove the tag ranges covering the given range
+          # and appends any trailing value that might
+          # exist after removal of range
           def remove_tags range
             return unless tracked?
 
@@ -112,19 +91,7 @@ module Contrast
               value.each do |tag|
                 comparison = tag.compare_range(range.begin, range.end)
                 # ABOVE and BELOW are not affected by this check
-                case comparison
-                when Contrast::Agent::Assess::Tag::LOW_SPAN
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::WITHIN
-                  remove << tag
-                when Contrast::Agent::Assess::Tag::WITHOUT
-                  new_tag = tag.clone
-                  new_tag.update_start(range.end)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN
-                  tag.update_start(range.end)
-                end
+                tags_remove_comparison comparison, tag, remove, add, range
               end
               value.delete_if { |tag| remove.include?(tag) }
               Contrast::Utils::TagUtil.ordered_merge(value, add)
@@ -133,6 +100,29 @@ module Contrast
             full_delete.each { |key| tags.delete(key) }
           end
 
+          # This method is for the tags comparison
+          # the idea is to move the whole case here
+          # @param comparison [String] indicates type of removal is to occur
+          # @param tag Contrast::Agent::Assess::Tag
+          # @param remove [String] holds removed Tag if exists
+          # @param add [String] holds trailing Tag if exists
+          # @param range [Range] start and stop for idx for removal
+          def tags_remove_comparison comparison, tag, remove, add, range
+            case comparison
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::WITHIN
+              remove << tag
+            when Contrast::Agent::Assess::Tag::WITHOUT
+              new_tag = tag.clone
+              new_tag.update_start(range.end)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN
+              tag.update_start(range.end)
+            end
+          end
+
           # Shift the tag ranges covering the given range
           # We assume this is for a deletion, meaning we
           # have to move tags to the left
@@ -176,32 +166,36 @@ module Contrast
                 comparison = tag.compare_range(range.begin, range.end)
                 length = range.end - range.begin
                 # BELOW is not affected by this check
-                case comparison
-                  # part of the tag is being inserted on
-                when Contrast::Agent::Assess::Tag::LOW_SPAN
-                  new_tag = tag.clone
-                  new_tag.update_start(range.begin)
-                  new_tag.shift(length)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                  # the tag exists in the inserted range. it is partially shifted
-                when Contrast::Agent::Assess::Tag::WITHIN
-                  tag.shift(length)
-                  # the tag spans the range. leave the part below alone
-                when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
-                  new_tag = tag.clone
-                  new_tag.update_start(range.begin)
-                  new_tag.shift(length)
-                  add << new_tag
-                  tag.update_end(range.begin)
-                when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
-                  tag.shift(length)
-                end
+                shift_tags_comparison comparison, add, tag, length, range
               end
               Contrast::Utils::TagUtil.ordered_merge(value, add)
             end
           end
 
+          def shift_tags_comparison comparison, add, tag, length, range
+            case comparison
+              # part of the tag is being inserted on
+            when Contrast::Agent::Assess::Tag::LOW_SPAN
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+              # the tag exists in the inserted range. it is partially shifted
+            when Contrast::Agent::Assess::Tag::WITHIN
+              tag.shift(length)
+              # the tag spans the range. leave the part below alone
+            when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
+              new_tag = tag.clone
+              new_tag.update_start(range.begin)
+              new_tag.shift(length)
+              add << new_tag
+              tag.update_end(range.begin)
+            when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/DuplicateBranch
+              tag.shift(length)
+            end
+          end
+
           private
 
           # Because of the auto-fill thing, we should not allow direct access to

data/lib/contrast/agent/assess/property/updated.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/duck_utils'

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -95,24 +95,6 @@ module Contrast
 
               children[1] == :bytes
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a byte array, or at least an array of numbers, it
-            # passes for this rule
-            def value_type_passes? value
-              return false unless value.is_a?(Array) && value.any?
-
-              value.each do |byte|
-                return false unless byte.is_a?(Integer)
-              end
-              true
-            end
-
-            # There isn't a filter for the byte value. The check is not evaluated
-            # for this rule
-            def value_passes? _value
-              true
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -71,18 +71,6 @@ module Contrast
             def redacted_marker
               REDACTED_MARKER
             end
-
-            # TODO: RUBY-1014 remove `#value_type_passes?` and `#value_passes?`
-            # If the value is a string, it passes for this rule
-            def value_type_passes? value
-              value.is_a?(String)
-            end
-
-            # If the value probably isn't a property name, it passes for this
-            # rule
-            def value_passes? value
-              !probably_property_name?(value)
-            end
           end
         end
       end