contrast-agent 4.3.2 → 4.7.0

data/lib/contrast/agent/patching/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'json'
@@ -13,8 +13,9 @@ module Contrast
   module Agent
     module Patching
       module Policy
-        # This is just a holder for our policy. Takes the policy JSON and
-        # converts it into hashes that we can access nicely
+        # This is just a holder for our policy. Takes the policy JSON and converts it into hashes that we can access
+        # nicely.
+        #
         # @abstract
         class Policy
           include Singleton
@@ -25,8 +26,8 @@ module Contrast
             raise(NoMethodError, 'specify policy_folder for patching')
           end
 
-          # Indicates is this feature has been disabled by the configuration,
-          # read at startup, and therefore can never be enabled.
+          # Indicates is this feature has been disabled by the configuration, read at startup, and therefore can never
+          # be enabled.
           def disabled_globally?
             raise(NoMethodError, 'specify disabled_globally? conditions for patching')
           end
@@ -58,17 +59,15 @@ module Contrast
             from_hash_string(json)
           end
 
-          # Our policy for patching rules is a 'dope ass' JSON file. Rather than
-          # hard code in a bunch of things to monkey patch, we let the JSON file
-          # define the conditions in which modifications are applied.
-          # This let's us be flexible and extensible.
+          # Our policy for patching rules is a 'dope ass' JSON file. Rather than hard code in a bunch of things to
+          # monkey patch, we let the JSON file define the conditions in which modifications are applied. This let's us
+          # be flexible and extensible.
           def from_hash_string string
-            # The default behavior of the agent is to load the policy on startup,
-            # as at this point we do not know in which mode we'll be run.
+            # The default behavior of the agent is to load the policy on startup, as at this point we do not know in
+            # which mode we'll be run.
             #
-            # If the configuration file explicitly disables a feature, we know
-            # that we will not ever be able to enable it, so in that case, we
-            # can skip policy loading.
+            # If the configuration file explicitly disables a feature, we know that we will not ever be able to enable
+            # it, so in that case, we can skip policy loading.
             return if disabled_globally?
 
             policy_data = JSON.parse(string)
@@ -110,13 +109,7 @@ module Contrast
           end
 
           def module_names
-            @_module_names ||= begin
-              m = Set.new
-              sources.each { |source| m << source.class_name }
-              propagators.each { |propagator| m << propagator.class_name }
-              triggers.each { |trigger| m << trigger.class_name }
-              m
-            end
+            @_module_names ||= Set.new([sources, propagators, triggers].flatten.map!(&:class_name))
           end
 
           def find_triggers_by_rule rule_id

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -44,10 +44,20 @@ module Contrast
           # later on. Really, if they don't have these things, they couldn't have
           # done their jobs anyway.
           def validate
-            raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.") unless class_name
-            raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.") unless method_name
-            raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.") unless method_name.is_a?(Symbol)
-            raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.") unless method_visibility.is_a?(Symbol)
+            unless class_name
+              raise(ArgumentError, "#{ node_class } #{ id } did not have a proper class name. Unable to create.")
+            end
+            unless method_name
+              raise(ArgumentError, "#{ node_class } #{ id } did not have a proper method name. Unable to create.")
+            end
+            unless method_name.is_a?(Symbol)
+              raise(ArgumentError, "#{ node_class } #{ id } has a non symbol @method_name value. Unable to create.")
+            end
+
+            unless method_visibility.is_a?(Symbol)
+              raise(ArgumentError,
+                    "#{ node_class } #{ id } has a non symbol @method_visibility value. Unable to create.")
+            end
             unless method_scope.nil? || Contrast::Agent::Scope.valid_scope?(method_scope)
               raise(ArgumentError, "#{ node_class } #{ id } requires an undefined scope. Unable to create.")
             end

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'
@@ -21,7 +21,8 @@ module Contrast
           JSON_OPTIONAL_PROPS = 'optional_properties'
           JSON_ON_EXCEPTION = 'on_exception'
 
-          attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties, :rule_id
+          attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties,
+                      :rule_id
 
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)
@@ -42,27 +43,42 @@ module Contrast
 
           def validate
             super
-            unless applicator.public_methods(false).any? { |method| method == applicator_method }
+            unless applicator.public_methods(false).any?(applicator_method)
               raise(ArgumentError,
-                    "#{ id } did not have a proper applicator method: #{ applicator } does not respond to #{ applicator_method }. Unable to create.")
+                    "#{ id } did not have a proper applicator method: "\
+                    "#{ applicator } does not respond to #{ applicator_method }. Unable to create.")
             end
+            validate_properties
+            validate_rule
+          end
+
+          def validate_properties
             if (required_properties & optional_properties).any?
-              raise(ArgumentError, "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
+              raise(ArgumentError,
+                    "#{ rule_id } had overlapping elements between required and optional properties. Unable to create.")
             end
             if (properties.keys - (required_properties | optional_properties)).any?
               raise(ArgumentError, "#{ id } had an unexpected property. Unable to create.")
             end
-            raise(ArgumentError, "#{ id } did not have a required property. Unable to create.") if (required_properties - properties.keys).any?
 
-            validate_rule
+            return unless (required_properties - properties.keys).any?
+
+            raise(ArgumentError, "#{ id } did not have a required property. Unable to create.")
           end
 
           def validate_rule
             raise(ArgumentError, 'Unknown rule did not have a proper name. Unable to create.') unless rule_id
             raise(ArgumentError, "#{ id } did not have a proper applicator. Unable to create.") unless applicator
-            raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.") unless applicator_method
-            raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.") unless required_properties
-            raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.") unless optional_properties
+
+            unless applicator_method
+              raise(ArgumentError, "#{ id } did not have a proper applicator method. Unable to create.")
+            end
+            unless required_properties
+              raise(ArgumentError, "#{ id } did not have a proper set of required properties. Unable to create.")
+            end
+            return if optional_properties
+
+            raise(ArgumentError, "#{ id } did not have a proper set of optional properties. Unable to create.")
           end
 
           private

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/cmd_injection'
@@ -37,7 +37,7 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::CmdInjection::NAME
             end
 

data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/deserialization'
@@ -71,7 +71,7 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::Deserialization::NAME
             end
 

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/no_sqli'
@@ -34,7 +34,7 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::NoSqli::NAME
             end
 

data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/path_traversal'
@@ -42,15 +42,14 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::PathTraversal::NAME
             end
 
             private
 
             def possible_write? input
-              input.cs__respond_to?(:to_s) &&
-                  input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
+              input.cs__respond_to?(:to_s) && input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
             end
 
             READ = 'read'

data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/sqli'
@@ -34,7 +34,7 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::Sqli::NAME
             end
 

data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/xxe'
@@ -49,16 +49,15 @@ module Contrast
 
             protected
 
-            def name
+            def rule_name
               Contrast::Agent::Protect::Rule::Xxe::NAME
             end
 
             private
 
-            DATA_KEY = '@data'.to_sym
+            DATA_KEY = :@data
             def valid_data_input? object
-              object.instance_variable_defined?(DATA_KEY) &&
-                  object.instance_variable_get(DATA_KEY)
+              object.instance_variable_defined?(DATA_KEY) && object.instance_variable_get(DATA_KEY)
             end
 
             NOKOGIRI_MARKER = 'Nokogiri::'
@@ -115,11 +114,8 @@ module Contrast
               raise e
             rescue StandardError => e
               parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-              logger.error(
-                  'Error applying xxe',
-                  e,
-                  module: potential_parser.cs__class.cs__name,
-                  method: method, parser: parser)
+              logger.error('Error applying xxe', e, module: potential_parser.cs__class.cs__name, method: method,
+                                                    parser: parser)
             end
           end
         end

data/lib/contrast/agent/protect/policy/policy.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy'

data/lib/contrast/agent/protect/policy/rule_applicator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -42,7 +42,8 @@ module Contrast
           rescue Contrast::SecurityException => e
             raise e
           rescue StandardError => e
-            logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method, rule: name)
+            logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method,
+                                                           rule: rule_name)
           end
 
           protected
@@ -68,11 +69,10 @@ module Contrast
             raise NoMethodError, 'This is abstract, override it.'
           end
 
-          # The name of the rule, as expected by the Contrast Service and
-          # Contrast UI.
+          # The name of the rule, as expected by the Contrast Service and Contrast UI.
           #
           # @return [String]
-          def name
+          def rule_name
             raise NoMethodError, 'This is abstract, override it.'
           end
 
@@ -82,7 +82,7 @@ module Contrast
           #
           # @return [Contrast::Agent::Protect::Rule::Base]
           def rule
-            PROTECT.rule name
+            PROTECT.rule rule_name
           end
 
           # Should we skip analysis for this rule for this method invocation?

data/lib/contrast/agent/protect/policy/trigger_node.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/trigger_node'

data/lib/contrast/agent/protect/rule.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/base.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -36,42 +36,31 @@ module Contrast
 
           attr_reader :mode
 
-          def initialize default_mode = Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
-            PROTECT.rules[name] = self
-            @mode = mode_from_settings || default_mode
+          def initialize
+            PROTECT.rules[rule_name] = self
+            @mode = mode_from_settings
           end
 
           # Should return the name as it is known to Teamserver; defaults to class
-          def name
-            cs__class.name
+          def rule_name
+            cs__class.cs__name
           end
 
-          OFF = 'off'
-
           def enabled?
             # 1. it is not enabled because protect is not enabled
             return false unless AGENT.enabled?
             return false unless PROTECT.enabled?
 
-            rule_configs = PROTECT.rule_config
-            unless rule_configs.nil?
-              # 2. it is not enabled because it is in the list of disabled protect rules
-              disabled_rules = rule_configs.disabled_rules
-              return false if disabled_rules&.include?(name)
-
-              # 3. it is not enabled because it has been turned "off" explicitly
-              rule_config = rule_configs.send(name)
-
-              return rule_config.mode != OFF unless rule_config.mode.nil?
-            end
+            # 2. it is not enabled because it is in the list of disabled protect rules
+            return false if PROTECT.rule_config&.disabled_rules&.include?(rule_name)
 
-            # 4. it is not enabled because it's mode is :NO_ACTION
-            @mode != :NO_ACTION
+            # 3. it is enabled so long as its mode is not NO_ACTION
+            @mode != Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
           end
 
           def excluded? exclusions
             Array(exclusions).any? do |ex|
-              ex.protection_rule?(name)
+              ex.protection_rule?(rule_name)
             end
           end
 
@@ -187,8 +176,8 @@ module Contrast
           protected
 
           def mode_from_settings
-            PROTECT.rule_mode(name).tap do |mode|
-              logger.trace('Retrieving rule mode', rule: name, mode: mode)
+            PROTECT.rule_mode(rule_name).tap do |mode|
+              logger.trace('Retrieving rule mode', rule: rule_name, mode: mode)
             end
           end
 
@@ -205,7 +194,7 @@ module Contrast
             exclusions = SETTINGS.code_exclusions
             return false unless exclusions
 
-            for_rule = exclusions.select { |ex| ex.protection_rule?(name) }
+            for_rule = exclusions.select { |ex| ex.protection_rule?(rule_name) }
             return false if for_rule.empty?
 
             stack = caller_locations
@@ -224,7 +213,7 @@ module Contrast
           # @param _kwargs [Hash] key-value pairs used by the rule to build a
           #   report.
           def find_attacker _context, _potential_attack_string, **_kwargs
-            raise NoMethodError, "Rule #{ name } did not implement find_attack"
+            raise NoMethodError, "Rule #{ rule_name } did not implement find_attack"
           end
 
           def update_successful_attack_response context, ia_result, result, attack_string = nil
@@ -260,7 +249,7 @@ module Contrast
           # @return [Contrast::Api::Dtm::AttackResult]
           def build_attack_result _context
             result = Contrast::Api::Dtm::AttackResult.new
-            result.rule_id = name
+            result.rule_id = rule_name
             result
           end
 
@@ -297,7 +286,7 @@ module Contrast
 
           def log_rule_matched _context, ia_result, response, _matched_string = nil
             logger.debug('A successful attack was detected',
-                         rule: name,
+                         rule: rule_name,
                          type: ia_result&.input_type,
                          name: ia_result&.key,
                          input: ia_result&.value,
@@ -307,11 +296,8 @@ module Contrast
           private
 
           def log_rule_probed _context, ia_result
-            logger.debug('An unsuccessful attack was detected',
-                         rule: name,
-                         type: ia_result&.input_type,
-                         name: ia_result&.key,
-                         input: ia_result&.value)
+            logger.debug('An unsuccessful attack was detected', rule: rule_name, type: ia_result&.input_type,
+                                                                name: ia_result&.key, input: ia_result&.value)
           end
         end
       end