contrast-agent 4.3.1 → 4.6.0

data/lib/contrast/components/scope.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'fiber'
@@ -109,6 +109,7 @@ module Contrast
 
         def with_deserialization_scope
           scope_for_current_ec.enter_deserialization_scope!
+          yield
         ensure
           scope_for_current_ec.exit_deserialization_scope!
         end

data/lib/contrast/components/settings.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,133 +8,61 @@ module Contrast
     # directives (likely provided by TeamServer) about product operation.
     # 'Settings' is not a generic term for 'configurable stuff'.
     module Settings
+      APPLICATION_STATE_BASE = Struct.new(:modes_by_id, :exclusion_matchers).new(
+          Hash.new { Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION }, [])
+      PROTECT_STATE_BASE = Struct.new(:enabled, :rules).new(false, {})
+      ASSESS_STATE_BASE = Struct.new(:enabled, :sampling_settings, :disabled_assess_rules).new(false, nil, []) do
+        def sampling_settings= new_val
+          @sampling_settings = new_val
+          Contrast::Utils::Assess::SamplingUtil.instance.update
+        end
+      end
+
       # This is a class.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
         access_component :config
 
-        attr_reader :assess_rules,
-                    :protect_rules
-
-        # Other stateful information that doesn't yet cleanly fit anywhere:
-
         # tainted_columns are database columns that receive unsanitized input.
-        # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
-
-        # These three 'state' variables represent atomic config/setting state,
-        # outside of things like rule defs.
-
-        def assess_state
-          @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              sampling_features: nil
-          }
-        end
-
-        def protect_state
-          @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false
-          }
-        end
-
-        def application_state
-          @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              modes_by_id: Hash.new(:NO_ACTION),
-              exclusion_matchers: [],
-              disabled_assess_rules: []
-          }
-        end
-
-        # These are settings that we receive & store.
-        # Rules are settings too, but they're more involved.
-        # So, between this block and rules, that's setting state.
-        PROTECT_STATE_ATTRS       = %i[].cs__freeze
-        ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
-
-        # Meta-define an accessor for each state attribute.
-
-        PROTECT_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            protect_state[attr]
-          end
-        end
-
-        ASSESS_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            assess_state[attr]
-          end
-        end
-
-        APPLICATION_STATE_ATTRS.each do |attr|
-          # TODO: RUBY-1052
-          define_method(attr) do # rubocop:disable Performance/Kernel/DefineMethod
-            application_state[attr]
-          end
-        end
+        attr_reader :assess_state, :protect_state, :application_state
 
         def initialize
           reset_state
         end
 
-        def protect_enabled?
-          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
-          @_protect_enabled
-        end
-
-        def assess_enabled?
-          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
-          @_assess_enabled
-        end
-
         def code_exclusions
-          exclusion_matchers.select(&:code?)
+          @application_state.exclusion_matchers.select(&:code?)
         end
 
+        # @param server_features [Contrast::Api::Settings::ServerFeatures]
         def update_from_server_features server_features
-          # protect
-
-          @_protect_enabled = nil
-          protect_state[:enabled] = server_features.protect_enabled?
-
-          # assess
-
-          @_assess_enabled = nil
-          assess_state[:enabled] = server_features.assess_enabled?
-          assess_state[:sampling_settings] = server_features.assess.sampling
-          Contrast::Utils::Assess::SamplingUtil.instance.update
+          @protect_state.enabled = server_features.protect_enabled?
+          @assess_state.enabled = server_features.assess_enabled?
+          @assess_state.sampling_settings = server_features.assess.sampling
         end
 
+        # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
         def update_from_application_settings application_settings
-          application_state.merge!(application_settings.application_state_translation)
+          new_vals = application_settings.application_state_translation
+          @application_state.modes_by_id = new_vals[:modes_by_id]
+          @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+          @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
         end
 
         # Wipe state to zero.
         def reset_state
-          @assess_rules = {}
-          @protect_rules = {}
-
+          @protect_state = PROTECT_STATE_BASE.dup
+          @assess_state = ASSESS_STATE_BASE.dup
+          @application_state = APPLICATION_STATE_BASE.dup
           @tainted_columns = {}
-
-          @assess_state = nil
-          @protect_state = nil
-          @application_state = nil
-        end
-
-        def build_assess_rules
-          @assess_rules = {}
-
-          Contrast::Agent::Assess::Rule::Redos.new
         end
 
         def build_protect_rules
-          @protect_rules = {}
+          @protect_state.rules = {}
 
-          # rules
+          # Rules. They add themselves on initialize.
           Contrast::Agent::Protect::Rule::CmdInjection.new
           Contrast::Agent::Protect::Rule::Deserialization.new
           Contrast::Agent::Protect::Rule::HttpMethodTampering.new

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/agent_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/application_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/default_value'

data/lib/contrast/config/assess_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/assess_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/base_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'forwardable'

data/lib/contrast/config/default_value.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/exception_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/heap_dump_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/inventory_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/logger_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'set'
@@ -18,6 +18,28 @@ module Contrast
       def initialize hsh
         super(hsh, KEYS)
       end
+
+      # To convert the user input mode from config to a standard format used by TS & SR, we need to convert the given
+      # String to its Contrast::Api::Settings::ProtectionRule::Mode equivalent. If a nonsense value is provided, it'll
+      # be treated the same as disabling the rule.
+      #
+      # @return [Contrast::Api::Settings::ProtectionRule::Mode, nil]
+      def applicable_mode
+        return unless mode
+
+        case mode
+        when 'permit'
+          Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+        when 'block_at_perimeter'
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
+        when 'block'
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
+        when 'monitor'
+          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
+        else
+          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
+        end
+      end
     end
   end
 end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/root_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/ruby_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/sampling_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/server_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/config/service_configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/config/default_value'

data/lib/contrast/configuration.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'yaml'

data/lib/contrast/delegators/input_analysis.rb

@@ -0,0 +1,12 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Delegators
+    # Used to decorate the InputAnalysis protobuf model so it can own the
+    # Contrast::Agent::Request from which it came.
+    class InputAnalysis < SimpleDelegator
+      attr_accessor :request
+    end
+  end
+end

data/lib/contrast/extension/assess.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/extension/assess/array.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/patch'

data/lib/contrast/extension/assess/erb.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This module is used to track propagation through ERB template rendering

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -24,9 +24,6 @@ module Contrast
           end
 
           def apply_trigger obj, source, ret, clazz, method
-            current_context = Contrast::Agent::REQUEST_TRACKER.current
-            return unless current_context
-
             # Since we know this is the source of the trigger, we can do some
             # optimization here and return when it is not tracked
             return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
@@ -35,7 +32,6 @@ module Contrast
             # about. we could pass in all the args in the last param here if it
             # becomes an issue in rendering on TS
             Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
-                current_context,
                 trigger_node(clazz, method),
                 source,
                 obj,

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/at_exit_hook'
@@ -11,9 +11,6 @@ module Contrast
       # the trigger at the start in order to account for the process hand off.
       module ExecTrigger
         def apply_trigger source
-          current_context = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_context
-
           # Since we know this is the source of the trigger, we can do some
           # optimization here and return when it is not tracked
           return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
@@ -22,7 +19,6 @@ module Contrast
           # about. we could pass in all the args in the last param here if it
           # becomes an issue in rendering on TS
           Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-              current_context,
               trigger_node,
               source,
               Kernel,

data/lib/contrast/extension/assess/fiber.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/propagation_node'

data/lib/contrast/extension/assess/hash.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'