contrast-agent 4.3.0 → 4.5.0

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/preshift'
@@ -38,13 +38,7 @@ module Contrast
                 source = find_source(propagation_node.sources[0], preshift)
                 return unless (source_properties = Contrast::Agent::Assess::Tracker.properties(source))
 
-                # grapheme_clusters break the string apart based on each "user-perceived" character.
-                # Otherwise, the default for String#split is to use a single whitespace.
-                separator_length = if propagation_node.method_name == :grapheme_clusters
-                                     0
-                                   else
-                                     preshift&.args&.first&.to_s&.length || $FIELD_SEPARATOR&.to_s&.length || 1
-                                   end
+                separator_length = find_separator_length(propagation_node, preshift)
 
                 current_index = 0
                 target.each do |target_elem|
@@ -126,6 +120,19 @@ module Contrast
 
               private
 
+              # grapheme_clusters break the string apart based on each "user-perceived" character. Otherwise, the
+              # default for String#split is to use a single whitespace.
+              #
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              def find_separator_length propagation_node, preshift
+                return 0 if propagation_node.method_name == :grapheme_clusters
+
+                preshift&.args&.first&.to_s&.length || $FIELD_SEPARATOR&.to_s&.length || 1
+              end
+
               # Save index of the current split object.
               # Create index tracking array as needed.
               def save_split_index!

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -95,10 +95,8 @@ module Contrast
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
                 incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
-                parent_event = incoming_properties&.event
-                parent_events << parent_event if parent_event
+                parent_events << incoming_properties&.event if incoming_properties&.event
 
-                pattern = preshift.args[0]
                 source = preshift.object
 
                 # We can't efficiently find the places that things were
@@ -111,6 +109,34 @@ module Contrast
 
                 # if it's just a straight insert, that we can do
                 # Copy the tags from us to the return
+                ranges = find_string_sub_insert(properties, preshift, incoming, ret, global)
+
+                properties.delete_tags_at_ranges(ranges)
+                properties.shift_tags(ranges)
+                return unless incoming_tracked
+                return unless incoming_properties
+
+                tags = incoming_properties.tag_keys
+                ranges.each do |range|
+                  tags.each do |tag|
+                    properties.add_tag(tag, range)
+                  end
+                end
+              end
+
+              # Find the points at which the new String was placed into the original
+              #
+              # @param properties [Contrast::Agent::Assess::Properties] the Properties of the ret
+              # @param preshift [Contrast::Agent::Assess::PreShift] the capture of the state of the code just prior to
+              #   the invocation of the patched method
+              # @param incoming [String] the new String going into the substitution
+              # @param ret [String] the result of the substitution
+              # @param global [Boolean] if this was a global or single substitution
+              # @return [Array<Range>] the Ranges where substitution occurred
+              def find_string_sub_insert properties, preshift, incoming, ret, global
+                pattern = preshift.args[0]
+                source = preshift.object
+
                 properties.copy_from(source, ret)
                 # Figure out where inserts occurred
                 last_idx = 0
@@ -126,17 +152,7 @@ module Contrast
                   ranges << (start_index...end_index)
                   break unless global
                 end
-                properties.delete_tags_at_ranges(ranges)
-                properties.shift_tags(ranges)
-                return unless incoming_tracked
-                return unless incoming_properties
-
-                tags = incoming_properties.tag_keys
-                ranges.each do |range|
-                  tags.each do |tag|
-                    properties.add_tag(tag, range)
-                  end
-                end
+                ranges
               end
 
               def block_sub self_tracked, source, ret

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch_status'

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -11,10 +11,9 @@ module Contrast
   module Agent
     module Assess
       module Policy
-        # This class controls the actions we take on Sources, as determined by
-        # our Assess policy. It indicates what actions we should take in order
-        # to mark data as User Input and treat it as untrusted, starting the
-        # dataflows used in Assess vulnerability detection.
+        # This class controls the actions we take on Sources, as determined by our Assess policy. It indicates what
+        # actions we should take in order to mark data as User Input and treat it as untrusted, starting the dataflows
+        # used in Assess vulnerability detection.
         module SourceMethod
           include Contrast::Components::Interface
           access_component :analysis, :logging
@@ -27,22 +26,17 @@ module Contrast
           COOKIE_KEY_TYPE    = 'COOKIE_KEY'
 
           class << self
-            # This is called from within our woven proc. It will be called as if it
-            # were inline in the Rack application.
+            # This is called from within our woven proc. It will be called as if it were inline in the Rack
+            # application.
             #
-            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy]
-            #   the policy that applies to the method being called
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
+            #   method being called
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [Object, nil] the tracked Return or nil if no changes
-            #   were made
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [Object, nil] the tracked Return or nil if no changes were made
             def source_patchers method_policy, object, ret, args
-              return if method_policy.source_node.nil?
-
-              current_context = Contrast::Agent::REQUEST_TRACKER.current
-              return unless current_context&.analyze_request? && ASSESS.enabled?
+              return unless analyze?(method_policy, object, ret, args)
 
               source_node = method_policy.source_node
               target = determine_target(source_node, object, ret, args)
@@ -62,29 +56,25 @@ module Contrast
                 # double check that we were able to finalize the replaced return
                 return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
-              apply_source(current_context, source_node, target, object, ret, source_node.type, nil, *args)
+              apply_source(Contrast::Agent::REQUEST_TRACKER.current, source_node, target, object, ret, source_node.type, nil, *args)
               restore_frozen_state ? ret : nil
             end
 
             private
 
-            # This is our method that actually taints the object our
-            # source_node targets.
+            # This is our method that actually taints the object our source_node targets.
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
+            # @param context [Contrast::Utils::ThreadTracker] the current request context
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
             # @param target [Object] the target of the Source Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param source_type [String] the type of this source, from the
-            #   source_node, or a KEY_TYPE if invoked for a map
-            # @param source_name [String, nil] the name of this source, i.e.
-            #   the key used to accessed if from a map or nil if a type like
-            #   BODY
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
+            #   nil if a type like BODY
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_source context, source_node, target, object, ret, source_type, source_name = nil, *args
               return unless context && source_node && target
 
@@ -95,9 +85,8 @@ module Contrast
                 apply_tags(source_node, target, object, ret, source_type, source_name, *args)
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
                 apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
-                # While we don't taint arrays themselves, we may taint the things
-                # they hold. Let's pass their keys and values back to ourselves and
-                # try again
+                # While we don't taint arrays themselves, we may taint the things they hold. Let's pass their keys and
+                # values back to ourselves and try again
               elsif Contrast::Utils::DuckUtils.iterable_enumerable?(target)
                 target.each { |value| apply_source(context, source_node, value, object, ret, source_type, source_name, *args) }
               end
@@ -105,27 +94,23 @@ module Contrast
               logger.warn('Unable to apply source', e, node_id: source_node.id)
             end
 
-            # While we don't taint hashes themselves, we may taint the things
-            # they hold. Let's pass their keys and values back to ourselves and
-            # try again
+            # While we don't taint hashes themselves, we may taint the things they hold. Let's pass their keys and
+            # values back to ourselves and try again
             #
-            # @param context [Contrast::Utils::ThreadTracker] the current request
-            #   context
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
+            # @param context [Contrast::Utils::ThreadTracker] the current request context
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
             # @param target [Object] the target of the Source Event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param source_type [String] the type of this source, from the
-            #   source_node, or a KEY_TYPE if invoked for a map
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
+            #   map
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             def apply_hash_tags context, source_node, target, object, ret, source_type, *args
               to_replace = []
               target.each_pair do |key, value|
-                # We only do this for Strings b/c of the way Hash lookup works.
-                # To replace another object would break hash lookup and,
-                # therefore, the application
+                # We only do this for Strings b/c of the way Hash lookup works. To replace another object would break
+                # hash lookup and, therefore, the application
                 if replace_hash_key?(key, target)
                   key = key.dup
                   to_replace << key
@@ -136,10 +121,8 @@ module Contrast
               handle_hash_key(target, to_replace)
             end
 
-            # Given an unfrozen hash, if the key is a String, we should replace
-            # it with one that we can finalize, allowing us to track that key.
-            # This method handles checking if that replace can and should
-            # occur.
+            # Given an unfrozen hash, if the key is a String, we should replace it with one that we can finalize,
+            # allowing us to track that key. This method handles checking if that replace can and should occur.
             #
             # @param key [Object] the key in the hash that may need replacing.
             # @param hash [Hash] the hash to which the key belongs.
@@ -160,9 +143,8 @@ module Contrast
               nil
             end
 
-            # Hash is designed to keep one instance of the string key in it.
-            # We need to remove the existing one and replace it with our new
-            # tracked one.
+            # Hash is designed to keep one instance of the string key in it. We need to remove the existing one and
+            # replace it with our new tracked one.
             def handle_hash_key target, to_replace
               to_replace.each do |key|
                 Contrast::Agent::Assess::Tracker.pre_freeze(key)
@@ -175,15 +157,12 @@ module Contrast
             def apply_tags source_node, target, object, ret, source_type, source_name, *args
               # don't apply tags if we can't track the thing
               return unless Contrast::Agent::Assess::Tracker.trackable?(target)
-              # don't apply second source -- probably needs tuning later if we
-              # use more than 'UNTRUSTED' in our sources
+              # don't apply second source -- probably needs tuning later if we use more than 'UNTRUSTED' in our sources
               return if Contrast::Agent::Assess::Tracker.tracked?(target)
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(target))
 
-              # otherwise for each tag this source_node applies, create a tag range
-              # on the target object
-              # I realize this looping is counter-intuitive from the above
-              # message, that's why we're revisiting.
+              # otherwise for each tag this source_node applies, create a tag range on the target object. I realize
+              # this looping is counter-intuitive from the above message, that's why we're revisiting.
               source_node.tags.each do |tag|
                 next unless Contrast::Agent::Assess::Policy::SourceValidation.valid?(tag, source_type, source_name)
 
@@ -201,15 +180,13 @@ module Contrast
 
             # Find the name of the source
             #
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
-            # @return [String, nil] the human readable name of the target to
-            #   which this source event applies, or nil if none provided by the
-            #   node
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [String, nil] the human readable name of the target to which this source event applies, or nil if
+            #   none provided by the node
             def determine_source_name source_node, object, ret, *args
               return source_node.get_property('dynamic_source_name') if source_node.type == 'UNTRUSTED_DATABASE'
 
@@ -226,14 +203,50 @@ module Contrast
               end
             end
 
+            # Determine if we should analyze this method invocation for a Source or not. We should if we have enough
+            # information to build the context of this invocation, we're not disabled, and we can't immediately
+            # determine the invocation was done safely.
+            #
+            # @param method_policy [Contrast::Agent::Patching::Policy::MethodPolicy] the policy that applies to the
+            #   method being called
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [boolean] if the invocation of this method should be analyzed
+            def analyze? method_policy, object, ret, args
+              return false unless method_policy&.source_node
+              return false unless ASSESS.enabled?
+              return false unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+
+              !safe_invocation?(method_policy.source_node, object, ret, args)
+            end
+
+            # Determine if the method was invoked safely.
+            #
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
+            # @param _object [Object] the Object on which the method was invoked
+            # @param _ret [Object] the Return of the invoked method
+            # @param args [Array<Object>] the Arguments with which the method was invoked
+            # @return [boolean] if the invocation of this method was safe
+            def safe_invocation? source_node, _object, _ret, args
+              # According the the Rack Specification https://github.com/rack/rack/blob/master/SPEC.rdoc, any header
+              # from the Request will start with HTTP_. As such, only Headers with that key should be considered for
+              # tracking, as the others have come from the Framework or Middleware stashing in the ENV. Rails, for
+              # instance, uses action_dispatch. to store several values. Technically, you can't call
+              # Rack::Request#get_header without a parameter, and that parameter should be a String, but trust no one.
+              source_node.id == 'Assess:Source:Rack::Request::Env#get_header' &&
+                  args&.any? &&
+                  !args[0].to_s.start_with?('HTTP_')
+            end
+
             # Find the literal target of the propagation
             #
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the node to direct applying this source event
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the node to direct applying this source
+            #   event
             # @param object [Object] the Object on which the method was invoked
             # @param ret [Object] the Return of the invoked method
-            # @param args [Array<Object>] the Arguments with which the method
-            #   was invoked
+            # @param args [Array<Object>] the Arguments with which the method was invoked
             # @return [Object] the target to which this source event applies
             def determine_target source_node, object, ret, args
               source_target = source_node.targets[0]
@@ -247,12 +260,10 @@ module Contrast
               end
             end
 
-            # Simple helper method to flip the type from value to key when the
-            # source is the key of a Hash
+            # Simple helper method to flip the type from value to key when the source is the key of a Hash
             #
             # @param source_type [String] the original value source type
-            # @return [String] the key form of the source type, if one exists,
-            #   else the original source type
+            # @return [String] the key form of the source type, if one exists, else the original source type
             def key_type source_type
               case source_type
               when PARAMETER_TYPE

data/lib/contrast/agent/assess/policy/source_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_method'
@@ -8,11 +8,13 @@ module Contrast
     module Assess
       module Policy
         module SourceValidation
-          # Validator used to assert a CROSS_SITE tag is actually applicable to
-          # the given method before applying the tag to its target
+          # Validator used to assert a CROSS_SITE tag is actually applicable to the given method before applying the
+          # tag to its target
           module CrossSiteValidator
-            # prevent the application of a tag if it is from a source known to
-            # not apply a tag in a provided context.
+            # Prevent the application of a tag if it is from a source known to not apply a tag in a provided context.
+            # Note that for Rack, the Header will be HTTP_REFERER. Rails does some help in
+            # ActionDispatch::Http::Headers to convert keys like `referer` to `HTTP_REFERER` before they get to the
+            # Rack::Request#get_header method
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
             def self.valid? tag, source_type, source_name
               return true unless tag == 'CROSS_SITE'
@@ -20,7 +22,7 @@ module Contrast
               return true unless source_type == Contrast::Agent::Assess::Policy::SourceMethod::HEADER_TYPE
               return false unless source_name
 
-              source_name.casecmp?('referer')
+              source_name == 'HTTP_REFERER'
             end
           end
         end

data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/source_validation/cross_site_validator'

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,7 +24,7 @@ module Contrast
               }.cs__freeze
               TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
 
-              def xss_tilt_trigger context, trigger_node, _source, object, ret, *args
+              def xss_tilt_trigger trigger_node, _source, object, ret, *args
                 return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
                 scope = args[0]
@@ -44,7 +44,7 @@ module Contrast
                 end
 
                 if Contrast::Agent::Assess::Tracker.tracked?(ret)
-                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, interpolated_inputs)
+                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node, ret, erb_template_prerender, ret, interpolated_inputs)
                 end
 
                 ret