contrast-agent 4.3.0 → 4.5.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.simplecov +1 -1
- data/Gemfile +1 -1
- data/LICENSE.txt +1 -1
- data/Rakefile +1 -1
- data/exe/contrast_service +1 -1
- data/ext/build_funchook.rb +1 -1
- data/ext/cs__assess_active_record_named/cs__active_record_named.c +1 -1
- data/ext/cs__assess_active_record_named/extconf.rb +1 -1
- data/ext/cs__assess_array/cs__assess_array.c +1 -1
- data/ext/cs__assess_array/extconf.rb +1 -1
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
- data/ext/cs__assess_basic_object/extconf.rb +1 -1
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
- data/ext/cs__assess_fiber_track/extconf.rb +1 -1
- data/ext/cs__assess_hash/cs__assess_hash.c +4 -2
- data/ext/cs__assess_hash/extconf.rb +1 -1
- data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
- data/ext/cs__assess_kernel/extconf.rb +1 -1
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
- data/ext/cs__assess_marshal_module/extconf.rb +1 -1
- data/ext/cs__assess_module/cs__assess_module.c +1 -1
- data/ext/cs__assess_module/extconf.rb +1 -1
- data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
- data/ext/cs__assess_regexp/extconf.rb +1 -1
- data/ext/cs__assess_string/cs__assess_string.c +1 -1
- data/ext/cs__assess_string/extconf.rb +1 -1
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
- data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
- data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
- data/ext/cs__assess_yield_track/extconf.rb +1 -1
- data/ext/cs__common/cs__common.c +5 -5
- data/ext/cs__common/cs__common.h +4 -4
- data/ext/cs__common/extconf.rb +1 -1
- data/ext/cs__contrast_patch/cs__contrast_patch.c +22 -25
- data/ext/cs__contrast_patch/extconf.rb +1 -1
- data/ext/cs__protect_kernel/cs__protect_kernel.c +1 -1
- data/ext/cs__protect_kernel/extconf.rb +1 -1
- data/ext/extconf_common.rb +1 -1
- data/lib/contrast-agent.rb +1 -1
- data/lib/contrast.rb +20 -1
- data/lib/contrast/agent.rb +6 -2
- data/lib/contrast/agent/assess.rb +1 -10
- data/lib/contrast/agent/assess/contrast_event.rb +54 -71
- data/lib/contrast/agent/assess/contrast_object.rb +6 -3
- data/lib/contrast/agent/assess/events/event_factory.rb +1 -1
- data/lib/contrast/agent/assess/events/source_event.rb +7 -2
- data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
- data/lib/contrast/agent/assess/finalizers/hash.rb +33 -34
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +30 -15
- data/lib/contrast/agent/assess/policy/patcher.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy_node.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
- data/lib/contrast/agent/assess/policy/preshift.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagation_method.rb +30 -19
- data/lib/contrast/agent/assess/policy/propagation_node.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/append.rb +29 -14
- data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +22 -17
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/select.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +24 -14
- data/lib/contrast/agent/assess/policy/propagator/split.rb +15 -8
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +31 -15
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +1 -1
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +1 -1
- data/lib/contrast/agent/assess/policy/source_method.rb +87 -76
- data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
- data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +8 -6
- data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +3 -3
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +7 -8
- data/lib/contrast/agent/assess/policy/trigger_method.rb +106 -64
- data/lib/contrast/agent/assess/policy/trigger_node.rb +31 -10
- data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +59 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -3
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +7 -5
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +3 -5
- data/lib/contrast/agent/assess/properties.rb +1 -3
- data/lib/contrast/agent/assess/property/evented.rb +1 -1
- data/lib/contrast/agent/assess/property/tagged.rb +38 -20
- data/lib/contrast/agent/assess/property/updated.rb +1 -1
- data/lib/contrast/agent/assess/rule/provider.rb +1 -1
- data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +1 -1
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +1 -1
- data/lib/contrast/agent/assess/tag.rb +1 -1
- data/lib/contrast/agent/assess/tracker.rb +2 -2
- data/lib/contrast/agent/at_exit_hook.rb +1 -1
- data/lib/contrast/agent/class_reopener.rb +1 -1
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
- data/lib/contrast/agent/deadzone/policy/policy.rb +1 -1
- data/lib/contrast/agent/disable_reaction.rb +1 -1
- data/lib/contrast/agent/exclusion_matcher.rb +1 -1
- data/lib/contrast/agent/inventory.rb +1 -2
- data/lib/contrast/agent/inventory/dependencies.rb +1 -1
- data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
- data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +35 -23
- data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
- data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
- data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
- data/lib/contrast/agent/middleware.rb +87 -58
- data/lib/contrast/agent/module_data.rb +1 -1
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +5 -1
- data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
- data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
- data/lib/contrast/agent/patching/policy/patch.rb +8 -6
- data/lib/contrast/agent/patching/policy/patch_status.rb +2 -2
- data/lib/contrast/agent/patching/policy/patcher.rb +59 -54
- data/lib/contrast/agent/patching/policy/policy.rb +1 -1
- data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
- data/lib/contrast/agent/patching/policy/trigger_node.rb +6 -3
- data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/policy.rb +1 -1
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
- data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
- data/lib/contrast/agent/protect/rule.rb +1 -1
- data/lib/contrast/agent/protect/rule/base.rb +7 -18
- data/lib/contrast/agent/protect/rule/base_service.rb +2 -2
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +2 -2
- data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
- data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -2
- data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -1
- data/lib/contrast/agent/protect/rule/sqli.rb +18 -12
- data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
- data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
- data/lib/contrast/agent/protect/rule/xss.rb +1 -1
- data/lib/contrast/agent/protect/rule/xxe.rb +1 -1
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -1
- data/lib/contrast/agent/railtie.rb +1 -1
- data/lib/contrast/agent/reaction_processor.rb +1 -1
- data/lib/contrast/agent/request.rb +2 -1
- data/lib/contrast/agent/request_context.rb +17 -10
- data/lib/contrast/agent/request_handler.rb +1 -1
- data/lib/contrast/agent/response.rb +1 -1
- data/lib/contrast/agent/rewriter.rb +1 -1
- data/lib/contrast/agent/rule_set.rb +3 -3
- data/lib/contrast/agent/scope.rb +1 -1
- data/lib/contrast/agent/service_heartbeat.rb +1 -1
- data/lib/contrast/agent/static_analysis.rb +1 -1
- data/lib/contrast/agent/thread.rb +2 -2
- data/lib/contrast/agent/thread_watcher.rb +21 -6
- data/lib/contrast/agent/tracepoint_hook.rb +1 -1
- data/lib/contrast/agent/version.rb +2 -2
- data/lib/contrast/agent/worker_thread.rb +1 -1
- data/lib/contrast/api.rb +1 -1
- data/lib/contrast/api/communication.rb +1 -1
- data/lib/contrast/api/communication/connection_status.rb +1 -1
- data/lib/contrast/api/communication/messaging_queue.rb +19 -22
- data/lib/contrast/api/communication/response_processor.rb +9 -2
- data/lib/contrast/api/communication/service_lifecycle.rb +1 -1
- data/lib/contrast/api/communication/socket.rb +1 -1
- data/lib/contrast/api/communication/socket_client.rb +23 -15
- data/lib/contrast/api/communication/speedracer.rb +3 -3
- data/lib/contrast/api/communication/tcp_socket.rb +1 -1
- data/lib/contrast/api/communication/unix_socket.rb +1 -1
- data/lib/contrast/api/decorators.rb +3 -1
- data/lib/contrast/api/decorators/address.rb +1 -1
- data/lib/contrast/api/decorators/agent_startup.rb +58 -0
- data/lib/contrast/api/decorators/application_settings.rb +1 -1
- data/lib/contrast/api/decorators/application_startup.rb +53 -0
- data/lib/contrast/api/decorators/application_update.rb +1 -1
- data/lib/contrast/api/decorators/http_request.rb +1 -1
- data/lib/contrast/api/decorators/input_analysis.rb +1 -1
- data/lib/contrast/api/decorators/instrumentation_mode.rb +37 -0
- data/lib/contrast/api/decorators/library.rb +1 -1
- data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
- data/lib/contrast/api/decorators/message.rb +1 -1
- data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
- data/lib/contrast/api/decorators/route_coverage.rb +16 -6
- data/lib/contrast/api/decorators/server_features.rb +1 -1
- data/lib/contrast/api/decorators/trace_event.rb +43 -15
- data/lib/contrast/api/decorators/trace_event_object.rb +1 -1
- data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
- data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
- data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -1
- data/lib/contrast/api/decorators/user_input.rb +1 -1
- data/lib/contrast/common_agent_configuration.rb +1 -1
- data/lib/contrast/components/agent.rb +3 -1
- data/lib/contrast/components/app_context.rb +5 -23
- data/lib/contrast/components/assess.rb +1 -1
- data/lib/contrast/components/config.rb +1 -1
- data/lib/contrast/components/contrast_service.rb +1 -1
- data/lib/contrast/components/heap_dump.rb +1 -1
- data/lib/contrast/components/interface.rb +1 -1
- data/lib/contrast/components/inventory.rb +1 -1
- data/lib/contrast/components/logger.rb +1 -1
- data/lib/contrast/components/protect.rb +4 -2
- data/lib/contrast/components/sampling.rb +49 -7
- data/lib/contrast/components/scope.rb +1 -1
- data/lib/contrast/components/settings.rb +7 -6
- data/lib/contrast/config.rb +1 -1
- data/lib/contrast/config/agent_configuration.rb +1 -1
- data/lib/contrast/config/application_configuration.rb +1 -1
- data/lib/contrast/config/assess_configuration.rb +1 -1
- data/lib/contrast/config/assess_rules_configuration.rb +1 -1
- data/lib/contrast/config/base_configuration.rb +1 -1
- data/lib/contrast/config/default_value.rb +1 -1
- data/lib/contrast/config/exception_configuration.rb +1 -1
- data/lib/contrast/config/heap_dump_configuration.rb +1 -1
- data/lib/contrast/config/inventory_configuration.rb +1 -1
- data/lib/contrast/config/logger_configuration.rb +1 -1
- data/lib/contrast/config/protect_configuration.rb +1 -1
- data/lib/contrast/config/protect_rule_configuration.rb +23 -1
- data/lib/contrast/config/protect_rules_configuration.rb +1 -1
- data/lib/contrast/config/root_configuration.rb +1 -1
- data/lib/contrast/config/ruby_configuration.rb +1 -1
- data/lib/contrast/config/sampling_configuration.rb +1 -1
- data/lib/contrast/config/server_configuration.rb +1 -1
- data/lib/contrast/config/service_configuration.rb +1 -1
- data/lib/contrast/configuration.rb +1 -1
- data/lib/contrast/delegators/input_analysis.rb +12 -0
- data/lib/contrast/extension/assess.rb +1 -1
- data/lib/contrast/extension/assess/array.rb +1 -1
- data/lib/contrast/extension/assess/erb.rb +1 -1
- data/lib/contrast/extension/assess/eval_trigger.rb +1 -5
- data/lib/contrast/extension/assess/exec_trigger.rb +1 -5
- data/lib/contrast/extension/assess/fiber.rb +1 -1
- data/lib/contrast/extension/assess/hash.rb +1 -1
- data/lib/contrast/extension/assess/kernel.rb +1 -1
- data/lib/contrast/extension/assess/marshal.rb +1 -5
- data/lib/contrast/extension/assess/regexp.rb +1 -1
- data/lib/contrast/extension/assess/string.rb +1 -1
- data/lib/contrast/extension/delegator.rb +1 -1
- data/lib/contrast/extension/inventory.rb +1 -1
- data/lib/contrast/extension/kernel.rb +1 -1
- data/lib/contrast/extension/module.rb +1 -1
- data/lib/contrast/extension/protect.rb +1 -1
- data/lib/contrast/extension/protect/kernel.rb +1 -1
- data/lib/contrast/extension/protect/psych.rb +1 -1
- data/lib/contrast/extension/thread.rb +1 -1
- data/lib/contrast/framework/base_support.rb +1 -1
- data/lib/contrast/framework/manager.rb +14 -13
- data/lib/contrast/framework/platform_version.rb +1 -1
- data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
- data/lib/contrast/framework/rack/patch/support.rb +1 -1
- data/lib/contrast/framework/rack/support.rb +1 -1
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
- data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +4 -4
- data/lib/contrast/framework/rails/patch/support.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_named.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
- data/lib/contrast/framework/rails/support.rb +43 -44
- data/lib/contrast/framework/sinatra/support.rb +101 -42
- data/lib/contrast/funchook/funchook.rb +1 -1
- data/lib/contrast/logger/application.rb +1 -1
- data/lib/contrast/logger/format.rb +1 -1
- data/lib/contrast/logger/log.rb +32 -16
- data/lib/contrast/logger/request.rb +1 -1
- data/lib/contrast/logger/time.rb +1 -1
- data/lib/contrast/security_exception.rb +1 -1
- data/lib/contrast/tasks/config.rb +1 -1
- data/lib/contrast/tasks/service.rb +1 -1
- data/lib/contrast/utils/assess/sampling_util.rb +1 -1
- data/lib/contrast/utils/assess/tracking_util.rb +1 -1
- data/lib/contrast/utils/class_util.rb +18 -4
- data/lib/contrast/utils/duck_utils.rb +1 -1
- data/lib/contrast/utils/env_configuration_item.rb +1 -1
- data/lib/contrast/utils/hash_digest.rb +14 -19
- data/lib/contrast/utils/heap_dump_util.rb +104 -88
- data/lib/contrast/utils/invalid_configuration_util.rb +22 -13
- data/lib/contrast/utils/inventory_util.rb +1 -1
- data/lib/contrast/utils/io_util.rb +1 -1
- data/lib/contrast/utils/job_servers_running.rb +1 -1
- data/lib/contrast/utils/object_share.rb +1 -1
- data/lib/contrast/utils/os.rb +1 -1
- data/lib/contrast/utils/preflight_util.rb +1 -1
- data/lib/contrast/utils/resource_loader.rb +1 -1
- data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
- data/lib/contrast/utils/sha256_builder.rb +1 -1
- data/lib/contrast/utils/stack_trace_utils.rb +1 -1
- data/lib/contrast/utils/string_utils.rb +1 -1
- data/lib/contrast/utils/tag_util.rb +1 -1
- data/lib/contrast/utils/thread_tracker.rb +1 -1
- data/lib/contrast/utils/timer.rb +1 -1
- data/resources/assess/policy.json +8 -11
- data/resources/deadzone/policy.json +7 -23
- data/ruby-agent.gemspec +56 -19
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +117 -161
- data/lib/contrast/agent/assess/rule.rb +0 -18
- data/lib/contrast/agent/assess/rule/base.rb +0 -52
- data/lib/contrast/agent/assess/rule/redos.rb +0 -67
- data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +0 -38
- data/lib/contrast/framework/sinatra/patch/base.rb +0 -83
- data/lib/contrast/framework/sinatra/patch/support.rb +0 -27
- data/lib/contrast/utils/prevent_serialization.rb +0 -52
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -9,7 +9,7 @@ module Contrast
|
|
9
9
|
# Validator used to assert a SSRF finding is actually vulnerable
|
10
10
|
# before serializing that finding as a DTM to report to the service.
|
11
11
|
module SSRFValidator
|
12
|
-
|
12
|
+
RULE_NAME = 'ssrf'
|
13
13
|
URL_PATTERN =
|
14
14
|
%r{(?<protocol>http|https|ftp|sftp|telnet|gopher|rtsp|rtsps|ssh|svn)://(?<host>[^/?]+)(?<path>/?[^?]*)(?<query_string>\?.*)?}i.cs__freeze
|
15
15
|
# The Net::HTTP class validates host format on instantiation. Since
|
@@ -23,7 +23,6 @@ module Contrast
|
|
23
23
|
# querystring
|
24
24
|
# https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/server_side_request_forgery.md
|
25
25
|
def self.valid? patcher, _object, _ret, args
|
26
|
-
return true unless SSRF_RULE == patcher&.rule_id
|
27
26
|
return true if patcher.id.to_s.start_with?(PATH_ONLY_PATCH_MARKER)
|
28
27
|
|
29
28
|
url = args[0].to_s
|
@@ -1,8 +1,9 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
|
5
5
|
require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
|
6
|
+
require 'contrast/agent/assess/policy/trigger_validation/redos_validator'
|
6
7
|
|
7
8
|
module Contrast
|
8
9
|
module Agent
|
@@ -15,7 +16,8 @@ module Contrast
|
|
15
16
|
module TriggerValidation
|
16
17
|
VALIDATORS = [
|
17
18
|
Contrast::Agent::Assess::Policy::TriggerValidation::SSRFValidator,
|
18
|
-
Contrast::Agent::Assess::Policy::TriggerValidation::XSSValidator
|
19
|
+
Contrast::Agent::Assess::Policy::TriggerValidation::XSSValidator,
|
20
|
+
Contrast::Agent::Assess::Policy::TriggerValidation::REDOSValidator
|
19
21
|
].cs__freeze
|
20
22
|
|
21
23
|
# Determines if the conditions in which this trigger was called are
|
@@ -32,9 +34,9 @@ module Contrast
|
|
32
34
|
# @return [Boolean] if the conditions are valid for the generation of
|
33
35
|
# a Contrast::Api::Dtm::Finding
|
34
36
|
def self.valid? patcher, object, ret, args
|
35
|
-
VALIDATORS.
|
36
|
-
|
37
|
-
|
37
|
+
specific_validator = VALIDATORS.find { |validator| validator::RULE_NAME == patcher&.rule_id }
|
38
|
+
return specific_validator.valid?(patcher, object, ret, args) if specific_validator
|
39
|
+
|
38
40
|
true
|
39
41
|
end
|
40
42
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -10,7 +10,7 @@ module Contrast
|
|
10
10
|
# vulnerable before serializing that finding as a DTM to report to
|
11
11
|
# the service.
|
12
12
|
module XSSValidator
|
13
|
-
|
13
|
+
RULE_NAME = 'reflected-xss'
|
14
14
|
SAFE_CONTENT_TYPES = %w[
|
15
15
|
/csv
|
16
16
|
/javascript
|
@@ -23,9 +23,7 @@ module Contrast
|
|
23
23
|
# A finding is valid for XSS if the response type is not one of
|
24
24
|
# those assumed to be safe
|
25
25
|
# https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
|
26
|
-
def self.valid?
|
27
|
-
return true unless XSS_RULE == patcher&.rule_id
|
28
|
-
|
26
|
+
def self.valid? _patcher, _object, _ret, _args
|
29
27
|
content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
|
30
28
|
return true unless content_type
|
31
29
|
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'base64'
|
@@ -6,7 +6,6 @@ require 'set'
|
|
6
6
|
require 'contrast/agent/assess/property/evented'
|
7
7
|
require 'contrast/agent/assess/property/tagged'
|
8
8
|
require 'contrast/agent/assess/property/updated'
|
9
|
-
require 'contrast/utils/prevent_serialization'
|
10
9
|
|
11
10
|
module Contrast
|
12
11
|
module Agent
|
@@ -18,7 +17,6 @@ module Contrast
|
|
18
17
|
# to properly convey the events that lead up to the state of the tracked
|
19
18
|
# user input.
|
20
19
|
class Properties
|
21
|
-
include Contrast::Utils::PreventSerialization
|
22
20
|
include Contrast::Agent::Assess::Property::Evented
|
23
21
|
include Contrast::Agent::Assess::Property::Tagged
|
24
22
|
include Contrast::Agent::Assess::Property::Updated
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/assess/events/event_factory'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/assess/tag'
|
@@ -91,28 +91,15 @@ module Contrast
|
|
91
91
|
|
92
92
|
at = Hash.new { |h, k| h[k] = [] }
|
93
93
|
tags.each_pair do |key, value|
|
94
|
-
add =
|
94
|
+
add = nil
|
95
95
|
value.each do |tag|
|
96
|
-
|
97
|
-
|
98
|
-
|
99
|
-
|
100
|
-
when Contrast::Agent::Assess::Tag::LOW_SPAN
|
101
|
-
add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
102
|
-
# the tag exists in the requested range, figure out the boundaries
|
103
|
-
when Contrast::Agent::Assess::Tag::WITHIN
|
104
|
-
start = tag.start_idx - range.begin
|
105
|
-
finish = range.size - start
|
106
|
-
add << Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
|
107
|
-
# the tag spans the requested range.
|
108
|
-
when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
|
109
|
-
add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
110
|
-
# part of the tag is being selected
|
111
|
-
when Contrast::Agent::Assess::Tag::HIGH_SPAN # rubocop:disable Lint/DuplicateBranch
|
112
|
-
add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
96
|
+
within_range = resize_to_range(tag, range)
|
97
|
+
if within_range
|
98
|
+
add ||= []
|
99
|
+
add << within_range
|
113
100
|
end
|
114
101
|
end
|
115
|
-
next
|
102
|
+
next unless add&.any?
|
116
103
|
|
117
104
|
at[key] = add
|
118
105
|
end
|
@@ -344,6 +331,37 @@ module Contrast
|
|
344
331
|
Contrast::Utils::TagUtil.ordered_merge(value, add)
|
345
332
|
end
|
346
333
|
end
|
334
|
+
|
335
|
+
private
|
336
|
+
|
337
|
+
# Given a tag, compare it to a given range and, if any part of that tag is within the range, return a new tag
|
338
|
+
# covering the union of the original tag and the range. This new tag will start at the
|
339
|
+
# max(tag.start, range.start) and end at min(tag.end, range.end)
|
340
|
+
#
|
341
|
+
# @param tag [Contrast::Agent::Assess::Tag] the Tag that may be in this range
|
342
|
+
# @param range [Range] the span to check, inclusive to exclusive
|
343
|
+
# @return [Contrast::Agent::Assess::Tag, nil] a new tag, truncated to only span within the given range or nil
|
344
|
+
# if no overlap exists
|
345
|
+
def resize_to_range tag, range
|
346
|
+
comparison = tag.compare_range(range.begin, range.end)
|
347
|
+
# BELOW and ABOVE are not applicable to this check and result in nil
|
348
|
+
case comparison
|
349
|
+
# part of the tag is being selected
|
350
|
+
when Contrast::Agent::Assess::Tag::LOW_SPAN
|
351
|
+
Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
352
|
+
# the tag exists in the requested range, figure out the boundaries
|
353
|
+
when Contrast::Agent::Assess::Tag::WITHIN
|
354
|
+
start = tag.start_idx - range.begin
|
355
|
+
finish = range.size - start
|
356
|
+
Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
|
357
|
+
# the tag spans the requested range.
|
358
|
+
when Contrast::Agent::Assess::Tag::WITHOUT # rubocop:disable Lint/DuplicateBranch
|
359
|
+
Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
360
|
+
# part of the tag is being selected
|
361
|
+
when Contrast::Agent::Assess::Tag::HIGH_SPAN # rubocop:disable Lint/DuplicateBranch
|
362
|
+
Contrast::Agent::Assess::Tag.new(tag.label, range.size)
|
363
|
+
end
|
364
|
+
end
|
347
365
|
end
|
348
366
|
end
|
349
367
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/utils/duck_utils'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/assess/policy/trigger_method'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/assess/finalizers/hash'
|
@@ -16,7 +16,7 @@ module Contrast
|
|
16
16
|
class << self
|
17
17
|
# Retrieve the properties of the given Object, iff they exist.
|
18
18
|
#
|
19
|
-
# @param source [Object] the thing for which to look up properties.
|
19
|
+
# @param source [Object, nil] the thing for which to look up properties.
|
20
20
|
# @return [Contrast::Agent::Assess::Properties, nil]
|
21
21
|
def properties source
|
22
22
|
PROPERTIES_HASH[source]
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/interface'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'ripper'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/patching/policy/policy_node'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/deadzone/policy/deadzone_node'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/interface'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/interface'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -10,6 +10,5 @@ module Contrast
|
|
10
10
|
end
|
11
11
|
|
12
12
|
require 'contrast/agent/inventory/dependencies'
|
13
|
-
require 'contrast/agent/inventory/gemfile_digest_cache'
|
14
13
|
require 'contrast/agent/inventory/dependency_usage_analysis'
|
15
14
|
require 'contrast/agent/inventory/dependency_analysis'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
module Contrast
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/inventory/dependencies'
|
@@ -1,10 +1,10 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
|
-
require 'contrast/agent/inventory/gemfile_digest_cache'
|
5
4
|
require 'contrast/agent/inventory/dependencies'
|
6
5
|
require 'contrast/components/interface'
|
7
6
|
require 'contrast/utils/object_share'
|
7
|
+
require 'set'
|
8
8
|
|
9
9
|
module Contrast
|
10
10
|
module Agent
|
@@ -20,33 +20,35 @@ module Contrast
|
|
20
20
|
def initialize
|
21
21
|
return unless enabled?
|
22
22
|
|
23
|
-
@
|
23
|
+
@lock = Mutex.new
|
24
|
+
@lock.synchronize { @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new } }
|
24
25
|
end
|
25
26
|
|
26
|
-
# This method is invoked once, along with the rest of our catchup code
|
27
|
-
#
|
27
|
+
# This method is invoked once, along with the rest of our catchup code to report libraries and their
|
28
|
+
# associated files that have already been loaded pre-contrast.
|
28
29
|
def catchup
|
29
30
|
return unless enabled?
|
30
31
|
|
31
32
|
loaded_specs.each do |_name, spec|
|
32
|
-
# Get a digest of the Gem file itself
|
33
|
+
# Get a digest of the Gem file itself.
|
33
34
|
next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
|
34
35
|
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
end
|
36
|
+
loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
|
37
|
+
|
38
|
+
new_files = loaded_files_from_gem.each_with_object(Set.new) do |file_path, set|
|
39
|
+
set << adjust_path_for_reporting(file_path, spec)
|
40
|
+
logger.trace('Recording loaded file for inventory analysis', line: file_path)
|
41
41
|
end
|
42
|
+
|
43
|
+
# Even if new_files is empty, still need to add digest key for library discovery.
|
44
|
+
@lock.synchronize { @gemdigest_cache[digest].merge(new_files) }
|
42
45
|
end
|
43
46
|
end
|
44
47
|
|
45
|
-
# This method is invoked once per TracePoint :end - to map a specific
|
46
|
-
#
|
48
|
+
# This method is invoked once per TracePoint :end - to map a specific file being required to the gem
|
49
|
+
# it belongs to.
|
47
50
|
#
|
48
|
-
# @param path [String] the result of TracePoint#path from the :end
|
49
|
-
# event in which the Module was defined
|
51
|
+
# @param path [String] the result of TracePoint#path from the :end event in which the Module was defined.
|
50
52
|
def associate_file path
|
51
53
|
return unless enabled?
|
52
54
|
|
@@ -64,21 +66,31 @@ module Contrast
|
|
64
66
|
return
|
65
67
|
end
|
66
68
|
report_path = adjust_path_for_reporting(path, spec)
|
67
|
-
@gemdigest_cache
|
69
|
+
@lock.synchronize { @gemdigest_cache[digest] << report_path }
|
68
70
|
rescue StandardError => e
|
69
71
|
logger.error('Unable to inventory file path', e, path: path)
|
70
72
|
end
|
71
73
|
|
72
|
-
# Populate the library_usages
|
73
|
-
# data stored in the @gemdigest_cache
|
74
|
+
# Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache
|
74
75
|
#
|
75
|
-
# @param activity [Contrast::Api::Dtm::Activity] the message to which
|
76
|
-
# to append the usage data
|
76
|
+
# @param activity [Contrast::Api::Dtm::Activity] the message to which to append the usage data
|
77
77
|
def generate_library_usage activity
|
78
78
|
return unless enabled?
|
79
|
-
return
|
79
|
+
return unless activity
|
80
|
+
|
81
|
+
# Copy gemdigest_cache and clear it in sync.
|
82
|
+
gem_spec_digest_to_files = @lock.synchronize do
|
83
|
+
copy = @gemdigest_cache.dup
|
84
|
+
@gemdigest_cache.clear
|
85
|
+
copy
|
86
|
+
end
|
80
87
|
|
81
|
-
|
88
|
+
gem_spec_digest_to_files.each_pair do |digest, files|
|
89
|
+
usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
|
90
|
+
activity.library_usages[usage.hash_code] = usage
|
91
|
+
end
|
92
|
+
rescue StandardError => e
|
93
|
+
logger.error('Unable to generate library usage.', e)
|
82
94
|
end
|
83
95
|
|
84
96
|
private
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/interface'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/inventory/policy/trigger_node'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/agent/patching/policy/trigger_node'
|
@@ -1,4 +1,4 @@
|
|
1
|
-
# Copyright (c)
|
1
|
+
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'ipaddr'
|
@@ -39,34 +39,14 @@ module Contrast
|
|
39
39
|
setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
|
40
40
|
unless AGENT.enabled?
|
41
41
|
logger.error(
|
42
|
-
'The Agent was unable to initialize before the application middleware was initialized.
|
42
|
+
'The Agent was unable to initialize before the application middleware was initialized. ' \
|
43
|
+
'Disabling permanently.')
|
43
44
|
AGENT.disable! # ensure the agent is disabled (probably redundant)
|
44
45
|
return
|
45
46
|
end
|
46
47
|
agent_startup_routine
|
47
48
|
end
|
48
49
|
|
49
|
-
# Startup the Agent as part of the initialization process:
|
50
|
-
# - start the service sending thread, responsible for sending and
|
51
|
-
# processing messages
|
52
|
-
# - start the heartbeat thread, which triggers service startup
|
53
|
-
# - start instrumenting libraries and do a 'catchup' patch for everything
|
54
|
-
# we didn't see get loaded
|
55
|
-
# - enable TracePoint, which handles all class loads and required
|
56
|
-
# instrumentation going forward
|
57
|
-
def agent_startup_routine
|
58
|
-
logger.debug_with_time('middleware: starting service') do
|
59
|
-
Contrast::Agent.thread_watcher.ensure_running?
|
60
|
-
end
|
61
|
-
|
62
|
-
logger.debug_with_time('middleware: instrument shared libraries and patch') do
|
63
|
-
Contrast::Agent::Patching::Policy::Patcher.patch
|
64
|
-
end
|
65
|
-
|
66
|
-
AGENT.enable_tracepoint
|
67
|
-
Contrast::Agent::AtExitHook.exit_hook
|
68
|
-
end
|
69
|
-
|
70
50
|
# This is where we're hooked into the middleware stack. If the agent is enabled, we're ready
|
71
51
|
# to do some processing on a per request basis. If not, we just pass the request along to the
|
72
52
|
# next middleware in the stack.
|
@@ -76,14 +56,11 @@ module Contrast
|
|
76
56
|
# @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back
|
77
57
|
# to the user up the Rack framework.
|
78
58
|
def call env
|
79
|
-
|
59
|
+
return app.call(env) unless AGENT.enabled?
|
80
60
|
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
else
|
85
|
-
app.call(env)
|
86
|
-
end
|
61
|
+
Contrast::Agent.heapdump_util.start_thread!
|
62
|
+
handle_first_request
|
63
|
+
call_with_agent(env)
|
87
64
|
end
|
88
65
|
|
89
66
|
private
|
@@ -103,6 +80,26 @@ module Contrast
|
|
103
80
|
end
|
104
81
|
end
|
105
82
|
|
83
|
+
# Startup the Agent as part of the initialization process:
|
84
|
+
# - start the service sending thread, responsible for sending and processing messages
|
85
|
+
# - start the heartbeat thread, which triggers service startup
|
86
|
+
# - start instrumenting libraries and do a 'catchup' patch for everything we didn't see get loaded
|
87
|
+
# - enable TracePoint, which handles all class loads and required instrumentation going forward
|
88
|
+
def agent_startup_routine
|
89
|
+
logger.debug_with_time('middleware: starting service') do
|
90
|
+
Contrast::Agent.thread_watcher.ensure_running?
|
91
|
+
end
|
92
|
+
|
93
|
+
logger.debug_with_time('middleware: instrument shared libraries and patch') do
|
94
|
+
Contrast::Agent::Patching::Policy::Patcher.patch
|
95
|
+
end
|
96
|
+
|
97
|
+
logger.debug_with_time('middleware: enabling tracepoint') do
|
98
|
+
AGENT.enable_tracepoint
|
99
|
+
end
|
100
|
+
Contrast::Agent::AtExitHook.exit_hook
|
101
|
+
end
|
102
|
+
|
106
103
|
# Some things have to wait until first request to happen, either because
|
107
104
|
# resolution is not complete or because the framework will preload
|
108
105
|
# classes, which confuses some of our instrumentation.
|
@@ -124,6 +121,7 @@ module Contrast
|
|
124
121
|
def force_patching
|
125
122
|
force_patch(ActionDispatch::FileHandler) if defined?(ActionDispatch::FileHandler)
|
126
123
|
force_patch(ActionDispatch::Http::MimeNegotiation) if defined?(ActionDispatch::Http::MimeNegotiation)
|
124
|
+
force_patch(ActionDispatch::Journey::Router) if defined?(ActionDispatch::Journey::Router)
|
127
125
|
force_patch(ActionView::Template) if defined?(ActionView::Template)
|
128
126
|
end
|
129
127
|
|
@@ -135,41 +133,24 @@ module Contrast
|
|
135
133
|
# This is where we process each request we intercept as a middleware. We make the request context
|
136
134
|
# available globally so that it can be accessed from anywhere. A RequestHandler object is made
|
137
135
|
# for each request, which handles prefilter and postfilter operations.
|
136
|
+
# @param env [Hash] the various variables stored by this and other Middlewares to know the state
|
137
|
+
# and values of this Request
|
138
|
+
# @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back
|
139
|
+
# to the user up the Rack framework.
|
138
140
|
def call_with_agent env
|
139
141
|
Contrast::Agent.thread_watcher.ensure_running?
|
140
|
-
return unless AGENT.enabled?
|
141
|
-
|
142
142
|
framework_request = Contrast::Agent.framework_manager.retrieve_request(env)
|
143
143
|
context = Contrast::Agent::RequestContext.new(framework_request)
|
144
144
|
response = nil
|
145
145
|
|
146
|
-
#
|
146
|
+
# Make the context available for the lifecycle of this request.
|
147
147
|
Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
|
148
148
|
logger.request_start
|
149
149
|
request_handler = Contrast::Agent::RequestHandler.new(context)
|
150
150
|
|
151
|
-
|
152
|
-
|
153
|
-
|
154
|
-
request_handler.ruleset.prefilter
|
155
|
-
end
|
156
|
-
|
157
|
-
response = application_code(env) # pass request down the Rack chain with original env
|
158
|
-
|
159
|
-
# postfilter sequence
|
160
|
-
with_contrast_scope do
|
161
|
-
context.extract_after(response) # update context with final response information
|
162
|
-
|
163
|
-
if Contrast::Agent.framework_manager.streaming?(env)
|
164
|
-
context.reset_activity
|
165
|
-
request_handler.stream_safe_postfilter
|
166
|
-
else
|
167
|
-
request_handler.ruleset.postfilter
|
168
|
-
# return response stored in the context in case any postfilter rules updated the response data
|
169
|
-
response = context.response&.rack_response || response
|
170
|
-
request_handler.send_activity_messages
|
171
|
-
end
|
172
|
-
end
|
151
|
+
pre_call_with_agent(context, request_handler)
|
152
|
+
response = application_code(env)
|
153
|
+
post_call_with_agent(context, env, request_handler, response)
|
173
154
|
ensure
|
174
155
|
logger.request_end
|
175
156
|
end
|
@@ -179,6 +160,47 @@ module Contrast
|
|
179
160
|
handle_exception(e)
|
180
161
|
end
|
181
162
|
|
163
|
+
# Handle the operations the Agent needs to accomplish prior to the Application code executing during this
|
164
|
+
# request.
|
165
|
+
#
|
166
|
+
# @param context [Contrast::Agent::RequestContext]
|
167
|
+
# @param request_handler [Contrast::Agent::RequestHandler]
|
168
|
+
def pre_call_with_agent context, request_handler
|
169
|
+
with_contrast_scope do
|
170
|
+
context.service_extract_request
|
171
|
+
request_handler.ruleset.prefilter
|
172
|
+
end
|
173
|
+
rescue StandardError => e
|
174
|
+
raise e if security_exception?(e)
|
175
|
+
|
176
|
+
logger.error('Unable to execute agent pre_call', e)
|
177
|
+
end
|
178
|
+
|
179
|
+
# Handle the operations the Agent needs to accomplish after the Application code executes during this request.
|
180
|
+
#
|
181
|
+
# @param context [Contrast::Agent::RequestContext]
|
182
|
+
# @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
|
183
|
+
# this Request
|
184
|
+
# @param request_handler [Contrast::Agent::RequestHandler]
|
185
|
+
# @param response [Array,Rack::Response]
|
186
|
+
def post_call_with_agent context, env, request_handler, response
|
187
|
+
with_contrast_scope do
|
188
|
+
context.extract_after(response) # update context with final response information
|
189
|
+
|
190
|
+
if Contrast::Agent.framework_manager.streaming?(env)
|
191
|
+
context.reset_activity
|
192
|
+
request_handler.stream_safe_postfilter
|
193
|
+
else
|
194
|
+
request_handler.ruleset.postfilter
|
195
|
+
request_handler.send_activity_messages
|
196
|
+
end
|
197
|
+
end
|
198
|
+
rescue StandardError => e
|
199
|
+
raise e if security_exception?(e)
|
200
|
+
|
201
|
+
logger.error('Unable to execute agent post_call', e)
|
202
|
+
end
|
203
|
+
|
182
204
|
def application_code env
|
183
205
|
logger.trace_with_time('application') do
|
184
206
|
app.call(env)
|
@@ -192,9 +214,7 @@ module Contrast
|
|
192
214
|
# We're only going to suppress SecurityExceptions indicating a blocked attack.
|
193
215
|
# And, only if the config.agent.ruby.exceptions.capture? is set
|
194
216
|
def handle_exception exception
|
195
|
-
if
|
196
|
-
exception.message&.include?(SECURITY_EXCEPTION_MARKER)
|
197
|
-
|
217
|
+
if security_exception?(exception)
|
198
218
|
exception_control = AGENT.exception_control
|
199
219
|
raise exception unless exception_control[:enable]
|
200
220
|
|
@@ -205,6 +225,15 @@ module Contrast
|
|
205
225
|
end
|
206
226
|
end
|
207
227
|
|
228
|
+
# Is the given exception one raised by our Protect code?
|
229
|
+
#
|
230
|
+
# @param exception [Exception]
|
231
|
+
# @return [Boolean]
|
232
|
+
def security_exception? exception
|
233
|
+
exception.is_a?(Contrast::SecurityException) ||
|
234
|
+
exception.message&.include?(SECURITY_EXCEPTION_MARKER)
|
235
|
+
end
|
236
|
+
|
208
237
|
# As we deprecate support to prepare to remove dead code, we need to
|
209
238
|
# inform our users still relying on the now deprecated and soon to be
|
210
239
|
# removed functionality. This method handles doing that by leveraging the
|