contrast-agent 4.14.1 → 5.0.0

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # The base class used to determine if a user input crosses a token boundary or

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/sql_sample_builder.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This class is the concrete implementation of the DefaultSqlScanner designed

data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'

data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'

data/lib/contrast/agent/protect/rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/reaction_processor.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/disable_reaction'

data/lib/contrast/agent/reporting/report.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -16,6 +16,12 @@ end
 require 'contrast/agent/reporting/reporter'
 require 'contrast/agent/reporting/reporting_utilities/audit'
 require 'contrast/agent/reporting/reporting_utilities/reporter_client'
+require 'contrast/agent/reporting/reporting_utilities/response_handler'
+require 'contrast/agent/reporting/reporting_utilities/response'
+# Events
 require 'contrast/agent/reporting/reporting_events/finding'
 require 'contrast/agent/reporting/reporting_events/preflight_message'
 require 'contrast/agent/reporting/reporting_events/preflight'
+require 'contrast/agent/reporting/reporting_events/observed_route'
+require 'contrast/agent/reporting/reporting_events/route_coverage'
+require 'contrast/agent/reporting/reporting_events/observed_library_usage'

data/lib/contrast/agent/reporting/reporter.rb

@@ -1,12 +1,9 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/worker_thread'
 require 'contrast/agent/reporting/report'
 require 'contrast/components/logger'
-require 'contrast/utils/object_share'
-require 'contrast/agent/version'
-require 'base64'
 
 module Contrast
   module Agent
@@ -14,10 +11,10 @@ module Contrast
     class Reporter < WorkerThread
       include Contrast::Components::Logger::InstanceMethods
       include Contrast::Utils::ObjectShare
+      # 15 min
+      TIMEOUT = 900.cs__freeze
 
       class << self
-        include Contrast::Components::Logger::InstanceMethods
-
         # check if we can report to TS
         #
         # @return[Boolean] true if bypass is enabled, or false if bypass disabled
@@ -27,25 +24,8 @@ module Contrast
         end
       end
 
-      def headers
-        @_headers ||= {
-            app_name: Base64.encode64(Contrast::APP_CONTEXT.app_name).chomp!,
-            api_key: Contrast::API.api_key,
-            agent_version: [RUBY, Contrast::Agent::VERSION].join(SPACE),
-            app_language: RUBY,
-            app_path: Base64.encode64(Contrast::APP_CONTEXT.path).chomp!,
-            app_version: Contrast::APP_CONTEXT.app_version,
-            authorization: Base64.encode64("#{ Contrast::API.username }:#{ Contrast::API.service_key }").chomp!,
-            server_name: Base64.encode64(Contrast::APP_CONTEXT.server_name).chomp!,
-            server_path: Base64.encode64(Contrast::APP_CONTEXT.server_path).chomp!,
-            server_type: Base64.encode64(Contrast::APP_CONTEXT.server_type).chomp!,
-            content_type: 'application/json',
-            encoding: 'base64'
-        }.cs__freeze
-      end
-
       def client
-        @_client ||= Contrast::Utils::ReporterClient.new headers
+        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
       end
 
       def connection
@@ -69,15 +49,19 @@ module Contrast
       def start_thread!
         return if running?
 
+        client.startup!(connection)
         @_thread = Contrast::Agent::Thread.new do
           logger.debug('Starting background Reporter thread.')
-          event = queue.pop
-
-          begin
-            logger.debug('This is the current processed event', event)
-            client.send_event event, connection
-          rescue StandardError => e
-            logger.error('Could not send message to service from Reporter queue.', e)
+          loop do
+            event = queue.pop
+            begin
+              response = client.send_event(event, connection)
+              audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
+            rescue StandardError => e
+              logger.error('Could not send message to service from Reporter queue.', e)
+            end
+            sleep(TIMEOUT) if client.sleep?
+            client.wake_up
           end
         end
       end
@@ -87,16 +71,12 @@ module Contrast
           logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
           return
         end
-
+        return unless event
         return unless cs__class.enabled?
 
         logger.debug('Enqueued event for sending', event_type: event.cs__class)
-
-        result = queue << event if event
-        return result unless ::Contrast::API.request_audit_enable
-
-        audit&.audit_event(event)
-        result
+        audit&.audit_event(event) if ::Contrast::API.request_audit_enable?
+        queue << event
       end
 
       # Use this to bypass the messaging queue and leave response processing to the caller
@@ -105,16 +85,9 @@ module Contrast
           logger.warn('Reporter attempted to send event immediately with Agent disabled', caller: caller, event: event)
           return
         end
-        response_data = client.send_event event, connection, true
-        if response_data.status == 200
-          # handle_response
-          client.send(:handle_response, event, response_data, connection)
-        end
-
-        return unless ::Contrast::API.request_audit_enable
-
-        audit&.audit_event(event, response_data)
-        response_data
+        response = client.send_event(event, connection, true)
+        client.send(:handle_response, event, response, connection) if response&.code == 200
+        audit&.audit_event(event, response) if ::Contrast::API.request_audit_enable?
       rescue StandardError => e
         logger.error('Could not send message to service from Reporter queue.', e)
       end

data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/agent/reporting/reporting_events/discovered_route'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationInventory class which will include all the needed information
+      # for the new reporting system to report
+      class ApplicationInventory < Contrast::Agent::Reporting::ReportingEvent
+        attr_accessor :routes, :agent_session_id_value
+
+        class << self
+          def convert app_update_dtm
+            app_inventory = new
+            app_inventory.attach_data app_update_dtm
+            app_inventory
+          end
+        end
+
+        def initialize
+          @routes = []
+          @event_type = :application_inventory
+          @event_method = :POST
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_inventory
+          super
+        end
+
+        def to_controlled_hash
+          {
+              session_id: agent_session_id_value,
+              routes: routes.map(&:to_controlled_hash)
+          }
+        end
+
+        # @param inventory_dtm [Contrast::Api::Dtm::ApplicationUpdate]
+        # @return [Contrast::Agent::Reporting::ApplicationInventory]
+        def attach_data inventory_dtm
+          inventory_dtm.routes.each do |route|
+            @routes << Contrast::Agent::Reporting::DiscoveredRoute.convert(route)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_update.rb

@@ -0,0 +1,82 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/agent/reporting/reporting_events/library_discovery'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/agent/reporting/reporting_events/route_discovery'
+require 'contrast/api/dtm.pb'
+require 'contrast/components/logger'
+require 'json'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Application Update class which will include all the needed information for the new reporting
+      # system. Contains data used by TeamServer to render the Flow Map and SCA features.
+      #
+      # @attr_reader components [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+      # @attr_reader libraries [Array<Contrast::Agent::Reporting::LibraryDiscovery>]
+      class ApplicationUpdate < Contrast::Agent::Reporting::ReportingEvent
+        attr_reader :components, :libraries
+
+        class << self
+          # @param app_update_dtm [Contrast::Api::Dtm::ApplicationUpdate]
+          # @return [Contrast::Agent::Reporting::ApplicationUpdate]
+          def convert app_update_dtm
+            report = new
+            report.attach_data(app_update_dtm)
+            report
+          end
+        end
+
+        def initialize
+          @event_method = :PUT
+          @event_endpoint = "#{ Contrast::API.api_url }/api/ng/update/application"
+          super
+        end
+
+        # Attach the data from the protobuf models to this reporter so that it can be sent to TeamServer directly.
+        #
+        # @param app_update_dtm [Contrast::Api::Dtm::ApplicationUpdate]
+        def attach_data app_update_dtm
+          @components = app_update_dtm.components.map do |component|
+            Contrast::Agent::Reporting::ArchitectureComponent.convert(component)
+          end
+          @libraries = app_update_dtm.libraries.values.map do |library|
+            Contrast::Agent::Reporting::LibraryDiscovery.convert(library)
+          end
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              components: components.map(&:to_controlled_hash),
+              libraries: libraries.map(&:to_controlled_hash),
+              timestamp: timestamp
+          }
+        end
+
+        # Ensure the required fields are present.
+        #
+        # @raise [ArgumentError]
+        def validate; end
+
+        private
+
+        # The timestamp field is a bit of a misnomer. It's really the time, in ms, since the settings for this
+        # application have been updated.
+        #
+        # @return [Integer]
+        def timestamp
+          Contrast::Utils::Timer.now_ms - (Contrast::Agent.reporter&.client&.response_handler&.last_app_update_ms || 0)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Architecture Component class which will include all the needed information for the new
+      # reporting system to relay this information in the Application Update and Application Activity messages. These
+      # components are used by TeamServer to construct the backend/ outbound connection section of the Flow Map
+      # feature.
+      #
+      # @attr_reader remote_host [String] the host section of the connection to the component.
+      # @attr_reader remote_port [Integer] the port section of the connection to the component.
+      # @attr_reader type [String] the type of the component. Only ::VALID_TYPES can be used. Required for reporting.
+      # @attr_reader url [String] the url used to connect to the component. Required for reporting.
+      # @attr_reader vendor [String] the publisher of the component, like MySQL.
+      class ArchitectureComponent
+        # required attributes
+        attr_reader :type, :url
+        # optional attributes
+        attr_reader :remote_host, :remote_port, :vendor
+
+        # TeamServer only treats these specific values as valid for Architecture Components. It does not know how to
+        # process a message with a different type.
+        VALID_TYPES = %w[db ldap ws].cs__freeze
+
+        class << self
+          # Convert a DTM for SpeedRacer to an Event for TeamServer.
+          #
+          # @param component_dtm [Contrast::Api::Dtm::ArchitectureComponent]
+          # @return [Contrast::Agent::Reporting::ArchitectureComponent]
+          def convert component_dtm
+            report = new
+            report.attach_data(component_dtm)
+            report
+          end
+        end
+
+        # Attach the data from the protobuf models to this reporter so that it can be sent to TeamServer directly.
+        #
+        # @param component_dtm [Contrast::Api::Dtm::ArchitectureComponent]
+        def attach_data component_dtm
+          @remote_host = component_dtm.remote_host
+          @remote_port = component_dtm.remote_port
+          @type = component_dtm.type
+          @url = component_dtm.url
+          @vendor = component_dtm.vendor
+        end
+
+        # Convert the instance variables on the class, and other information, into the identifiers required for
+        # TeamServer to process the JSON form of this message.
+        #
+        # @return [Hash]
+        # @raise [ArgumentError]
+        def to_controlled_hash
+          validate
+          {
+              remoteHost: remote_host,
+              remotePort: remote_port,
+              type: type,
+              url: url,
+              vendor: vendor
+          }
+        end
+
+        # Ensure the required fields are present.
+        #
+        # @raise [ArgumentError]
+        def validate
+          unless VALID_TYPES.include?(type)
+            raise(ArgumentError, "#{ self } did not have a proper type - '#{ type }'. Unable to continue.")
+          end
+          raise(ArgumentError, "#{ self } did not have a proper URL. Unable to continue.") unless url
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/discovered_route.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'json'
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new Discovered Route class which will include all the needed information for the new reporting
+      # system to relay this information in the Route Observation messages. These observations are used by TeamServer
+      # to construct the route coverage information for the assess feature. They represent those methods which map to
+      # externally accessible endpoints within the application, as registered to the application framework. This also
+      # includes the literal URL and HTTP Verb used to invoke them, as they must have been called at this point to be
+      # recorded.
+      class DiscoveredRoute < Contrast::Agent::Reporting::ObservedRoute
+        class << self
+          # @param dtm [Contrast::Api::Dtm::RouteCoverage]
+          # @return [Contrast::Agent::Reporting::DiscoveredRoute]
+          def convert dtm
+            discovered_route = new
+            discovered_route.attach_data dtm
+            discovered_route
+          end
+        end
+
+        def initialize
+          super
+          @event_type = :discovered_route
+          @signature = Contrast::Utils::ObjectShare::EMPTY_STRING
+          @verb = Contrast::Utils::ObjectShare::EMPTY_STRING
+          @url = Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # @param dtm[Contrast::Api::Dtm::RouteCoverage]
+        def attach_data dtm
+          @signature = dtm.route
+          @verb = dtm.verb
+          @url = dtm.url
+        end
+
+        def to_controlled_hash
+          validate
+          dr_hash = { session_id: @agent_session_id_value, signature: @signature, verb: @verb, url: @url }
+          dr_hash.delete(:verb) unless @verb
+          dr_hash
+        end
+
+        def validate
+          raise(ArgumentError, "#{ self } did not have a proper signature. Unable to continue.") unless signature
+
+          nil
+        end
+      end
+    end
+  end
+end