contrast-agent 4.3.2 → 4.7.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (317) hide show
  1. checksums.yaml +4 -4
  2. data/.gitmodules +1 -1
  3. data/.simplecov +1 -1
  4. data/Gemfile +1 -1
  5. data/LICENSE.txt +1 -1
  6. data/Rakefile +2 -3
  7. data/exe/contrast_service +1 -1
  8. data/ext/build_funchook.rb +4 -4
  9. data/ext/cs__assess_active_record_named/cs__active_record_named.c +1 -1
  10. data/ext/cs__assess_active_record_named/extconf.rb +1 -1
  11. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  12. data/ext/cs__assess_array/extconf.rb +1 -1
  13. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  14. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  15. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  16. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  17. data/ext/cs__assess_hash/cs__assess_hash.c +4 -2
  18. data/ext/cs__assess_hash/extconf.rb +1 -1
  19. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  20. data/ext/cs__assess_kernel/extconf.rb +1 -1
  21. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  22. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  23. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  24. data/ext/cs__assess_module/extconf.rb +1 -1
  25. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  26. data/ext/cs__assess_regexp/extconf.rb +1 -1
  27. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  28. data/ext/cs__assess_string/extconf.rb +1 -1
  29. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  30. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  31. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  32. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  33. data/ext/cs__common/cs__common.c +5 -5
  34. data/ext/cs__common/cs__common.h +4 -4
  35. data/ext/cs__common/extconf.rb +1 -1
  36. data/ext/cs__contrast_patch/cs__contrast_patch.c +22 -25
  37. data/ext/cs__contrast_patch/extconf.rb +1 -1
  38. data/ext/cs__protect_kernel/cs__protect_kernel.c +1 -1
  39. data/ext/cs__protect_kernel/extconf.rb +1 -1
  40. data/ext/extconf_common.rb +2 -6
  41. data/lib/contrast-agent.rb +1 -1
  42. data/lib/contrast.rb +20 -1
  43. data/lib/contrast/agent.rb +6 -4
  44. data/lib/contrast/agent/assess.rb +2 -11
  45. data/lib/contrast/agent/assess/contrast_event.rb +54 -71
  46. data/lib/contrast/agent/assess/contrast_object.rb +7 -4
  47. data/lib/contrast/agent/assess/events/event_factory.rb +3 -2
  48. data/lib/contrast/agent/assess/events/source_event.rb +7 -2
  49. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  50. data/lib/contrast/agent/assess/finalizers/hash.rb +33 -34
  51. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +34 -16
  52. data/lib/contrast/agent/assess/policy/patcher.rb +11 -18
  53. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/policy_node.rb +26 -34
  55. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/preshift.rb +4 -2
  57. data/lib/contrast/agent/assess/policy/propagation_method.rb +32 -30
  58. data/lib/contrast/agent/assess/policy/propagation_node.rb +20 -9
  59. data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
  60. data/lib/contrast/agent/assess/policy/propagator/append.rb +29 -14
  61. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/center.rb +3 -2
  63. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  64. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +22 -17
  65. data/lib/contrast/agent/assess/policy/propagator/insert.rb +4 -2
  66. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  67. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +3 -2
  68. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  69. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  70. data/lib/contrast/agent/assess/policy/propagator/remove.rb +23 -19
  71. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  72. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/propagator/select.rb +3 -13
  74. data/lib/contrast/agent/assess/policy/propagator/splat.rb +24 -14
  75. data/lib/contrast/agent/assess/policy/propagator/split.rb +18 -15
  76. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +32 -22
  77. data/lib/contrast/agent/assess/policy/propagator/trim.rb +64 -45
  78. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +7 -4
  79. data/lib/contrast/agent/assess/policy/source_method.rb +92 -81
  80. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  81. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +8 -6
  82. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +2 -4
  83. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +7 -3
  84. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +7 -8
  85. data/lib/contrast/agent/assess/policy/trigger_method.rb +109 -76
  86. data/lib/contrast/agent/assess/policy/trigger_node.rb +33 -11
  87. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +60 -0
  88. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +3 -5
  89. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +7 -5
  90. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +4 -13
  91. data/lib/contrast/agent/assess/properties.rb +1 -3
  92. data/lib/contrast/agent/assess/property/evented.rb +9 -6
  93. data/lib/contrast/agent/assess/property/tagged.rb +38 -20
  94. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  95. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  96. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +12 -6
  97. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +5 -2
  98. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +4 -6
  99. data/lib/contrast/agent/assess/tag.rb +1 -1
  100. data/lib/contrast/agent/assess/tracker.rb +2 -2
  101. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  102. data/lib/contrast/agent/class_reopener.rb +4 -2
  103. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  104. data/lib/contrast/agent/deadzone/policy/policy.rb +7 -3
  105. data/lib/contrast/agent/disable_reaction.rb +2 -4
  106. data/lib/contrast/agent/exclusion_matcher.rb +6 -12
  107. data/lib/contrast/agent/inventory.rb +1 -2
  108. data/lib/contrast/agent/inventory/dependencies.rb +3 -1
  109. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  110. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +35 -23
  111. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  112. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  113. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  114. data/lib/contrast/agent/middleware.rb +111 -110
  115. data/lib/contrast/agent/module_data.rb +4 -4
  116. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  117. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +9 -4
  118. data/lib/contrast/agent/patching/policy/method_policy.rb +7 -3
  119. data/lib/contrast/agent/patching/policy/module_policy.rb +15 -8
  120. data/lib/contrast/agent/patching/policy/patch.rb +23 -29
  121. data/lib/contrast/agent/patching/policy/patch_status.rb +8 -9
  122. data/lib/contrast/agent/patching/policy/patcher.rb +72 -64
  123. data/lib/contrast/agent/patching/policy/policy.rb +14 -21
  124. data/lib/contrast/agent/patching/policy/policy_node.rb +15 -5
  125. data/lib/contrast/agent/patching/policy/trigger_node.rb +26 -10
  126. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +2 -2
  127. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +2 -2
  128. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +2 -2
  129. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +3 -4
  130. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +2 -2
  131. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +6 -10
  132. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  133. data/lib/contrast/agent/protect/policy/rule_applicator.rb +6 -6
  134. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  135. data/lib/contrast/agent/protect/rule.rb +1 -1
  136. data/lib/contrast/agent/protect/rule/base.rb +19 -33
  137. data/lib/contrast/agent/protect/rule/base_service.rb +10 -6
  138. data/lib/contrast/agent/protect/rule/cmd_injection.rb +15 -19
  139. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  140. data/lib/contrast/agent/protect/rule/deserialization.rb +7 -14
  141. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +4 -15
  142. data/lib/contrast/agent/protect/rule/no_sqli.rb +7 -3
  143. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +2 -4
  144. data/lib/contrast/agent/protect/rule/path_traversal.rb +6 -6
  145. data/lib/contrast/agent/protect/rule/sqli.rb +19 -13
  146. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  147. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  148. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  149. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  150. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +2 -2
  151. data/lib/contrast/agent/protect/rule/xss.rb +2 -2
  152. data/lib/contrast/agent/protect/rule/xxe.rb +6 -13
  153. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +2 -3
  154. data/lib/contrast/agent/railtie.rb +1 -1
  155. data/lib/contrast/agent/reaction_processor.rb +12 -11
  156. data/lib/contrast/agent/request.rb +25 -24
  157. data/lib/contrast/agent/request_context.rb +25 -23
  158. data/lib/contrast/agent/request_handler.rb +1 -1
  159. data/lib/contrast/agent/response.rb +1 -1
  160. data/lib/contrast/agent/rewriter.rb +6 -4
  161. data/lib/contrast/agent/rule_set.rb +3 -3
  162. data/lib/contrast/agent/scope.rb +1 -1
  163. data/lib/contrast/agent/service_heartbeat.rb +3 -4
  164. data/lib/contrast/agent/static_analysis.rb +1 -1
  165. data/lib/contrast/agent/thread.rb +2 -2
  166. data/lib/contrast/agent/thread_watcher.rb +21 -6
  167. data/lib/contrast/agent/tracepoint_hook.rb +2 -2
  168. data/lib/contrast/agent/version.rb +2 -2
  169. data/lib/contrast/agent/worker_thread.rb +1 -1
  170. data/lib/contrast/api.rb +1 -1
  171. data/lib/contrast/api/communication.rb +1 -1
  172. data/lib/contrast/api/communication/connection_status.rb +1 -1
  173. data/lib/contrast/api/communication/messaging_queue.rb +19 -22
  174. data/lib/contrast/api/communication/response_processor.rb +13 -8
  175. data/lib/contrast/api/communication/service_lifecycle.rb +5 -3
  176. data/lib/contrast/api/communication/socket.rb +1 -1
  177. data/lib/contrast/api/communication/socket_client.rb +30 -35
  178. data/lib/contrast/api/communication/speedracer.rb +6 -10
  179. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  180. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  181. data/lib/contrast/api/decorators.rb +3 -1
  182. data/lib/contrast/api/decorators/address.rb +1 -1
  183. data/lib/contrast/api/decorators/agent_startup.rb +58 -0
  184. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  185. data/lib/contrast/api/decorators/application_startup.rb +57 -0
  186. data/lib/contrast/api/decorators/application_update.rb +1 -1
  187. data/lib/contrast/api/decorators/http_request.rb +1 -1
  188. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  189. data/lib/contrast/api/decorators/instrumentation_mode.rb +37 -0
  190. data/lib/contrast/api/decorators/library.rb +9 -7
  191. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  192. data/lib/contrast/api/decorators/message.rb +4 -4
  193. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  194. data/lib/contrast/api/decorators/route_coverage.rb +16 -6
  195. data/lib/contrast/api/decorators/server_features.rb +1 -1
  196. data/lib/contrast/api/decorators/trace_event.rb +46 -16
  197. data/lib/contrast/api/decorators/trace_event_object.rb +2 -4
  198. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  199. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  200. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +2 -7
  201. data/lib/contrast/api/decorators/user_input.rb +1 -1
  202. data/lib/contrast/components/agent.rb +16 -15
  203. data/lib/contrast/components/app_context.rb +11 -29
  204. data/lib/contrast/components/assess.rb +6 -11
  205. data/lib/contrast/components/config.rb +3 -2
  206. data/lib/contrast/components/contrast_service.rb +8 -9
  207. data/lib/contrast/components/heap_dump.rb +1 -1
  208. data/lib/contrast/components/interface.rb +4 -3
  209. data/lib/contrast/components/inventory.rb +1 -1
  210. data/lib/contrast/components/logger.rb +1 -1
  211. data/lib/contrast/components/protect.rb +11 -14
  212. data/lib/contrast/components/sampling.rb +55 -7
  213. data/lib/contrast/components/scope.rb +2 -1
  214. data/lib/contrast/components/settings.rb +29 -99
  215. data/lib/contrast/config.rb +1 -1
  216. data/lib/contrast/config/agent_configuration.rb +1 -1
  217. data/lib/contrast/config/application_configuration.rb +1 -1
  218. data/lib/contrast/config/assess_configuration.rb +1 -1
  219. data/lib/contrast/config/assess_rules_configuration.rb +2 -4
  220. data/lib/contrast/config/base_configuration.rb +5 -6
  221. data/lib/contrast/config/default_value.rb +1 -1
  222. data/lib/contrast/config/exception_configuration.rb +2 -6
  223. data/lib/contrast/config/heap_dump_configuration.rb +13 -7
  224. data/lib/contrast/config/inventory_configuration.rb +1 -1
  225. data/lib/contrast/config/logger_configuration.rb +2 -6
  226. data/lib/contrast/config/protect_configuration.rb +1 -1
  227. data/lib/contrast/config/protect_rule_configuration.rb +23 -1
  228. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  229. data/lib/contrast/config/root_configuration.rb +1 -1
  230. data/lib/contrast/config/ruby_configuration.rb +1 -1
  231. data/lib/contrast/config/sampling_configuration.rb +1 -1
  232. data/lib/contrast/config/server_configuration.rb +1 -1
  233. data/lib/contrast/config/service_configuration.rb +1 -1
  234. data/lib/contrast/configuration.rb +4 -15
  235. data/lib/contrast/delegators/input_analysis.rb +12 -0
  236. data/lib/contrast/extension/assess.rb +1 -1
  237. data/lib/contrast/extension/assess/array.rb +2 -7
  238. data/lib/contrast/extension/assess/erb.rb +2 -8
  239. data/lib/contrast/extension/assess/eval_trigger.rb +3 -11
  240. data/lib/contrast/extension/assess/exec_trigger.rb +4 -14
  241. data/lib/contrast/extension/assess/fiber.rb +3 -13
  242. data/lib/contrast/extension/assess/hash.rb +1 -1
  243. data/lib/contrast/extension/assess/kernel.rb +3 -10
  244. data/lib/contrast/extension/assess/marshal.rb +3 -11
  245. data/lib/contrast/extension/assess/regexp.rb +2 -7
  246. data/lib/contrast/extension/assess/string.rb +4 -2
  247. data/lib/contrast/extension/delegator.rb +1 -1
  248. data/lib/contrast/extension/inventory.rb +1 -1
  249. data/lib/contrast/extension/kernel.rb +5 -3
  250. data/lib/contrast/extension/module.rb +1 -1
  251. data/lib/contrast/extension/protect.rb +1 -1
  252. data/lib/contrast/extension/protect/kernel.rb +1 -1
  253. data/lib/contrast/extension/protect/psych.rb +1 -1
  254. data/lib/contrast/extension/thread.rb +1 -1
  255. data/lib/contrast/framework/base_support.rb +1 -1
  256. data/lib/contrast/framework/manager.rb +14 -17
  257. data/lib/contrast/framework/platform_version.rb +1 -1
  258. data/lib/contrast/framework/rack/patch/session_cookie.rb +6 -19
  259. data/lib/contrast/framework/rack/patch/support.rb +7 -5
  260. data/lib/contrast/framework/rack/support.rb +1 -1
  261. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  262. data/lib/contrast/framework/rails/patch/assess_configuration.rb +8 -3
  263. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +4 -4
  264. data/lib/contrast/framework/rails/patch/support.rb +5 -3
  265. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +5 -2
  266. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +3 -1
  267. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +3 -1
  268. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +3 -1
  269. data/lib/contrast/framework/rails/support.rb +45 -46
  270. data/lib/contrast/framework/sinatra/support.rb +103 -42
  271. data/lib/contrast/funchook/funchook.rb +2 -6
  272. data/lib/contrast/logger/application.rb +13 -10
  273. data/lib/contrast/logger/format.rb +3 -6
  274. data/lib/contrast/logger/log.rb +36 -19
  275. data/lib/contrast/logger/request.rb +2 -3
  276. data/lib/contrast/logger/time.rb +1 -1
  277. data/lib/contrast/security_exception.rb +2 -2
  278. data/lib/contrast/tasks/config.rb +1 -1
  279. data/lib/contrast/tasks/service.rb +6 -2
  280. data/lib/contrast/utils/assess/sampling_util.rb +1 -1
  281. data/lib/contrast/utils/assess/tracking_util.rb +2 -3
  282. data/lib/contrast/utils/class_util.rb +18 -12
  283. data/lib/contrast/utils/duck_utils.rb +1 -1
  284. data/lib/contrast/utils/env_configuration_item.rb +1 -1
  285. data/lib/contrast/utils/hash_digest.rb +16 -24
  286. data/lib/contrast/utils/heap_dump_util.rb +104 -88
  287. data/lib/contrast/utils/invalid_configuration_util.rb +22 -13
  288. data/lib/contrast/utils/inventory_util.rb +1 -1
  289. data/lib/contrast/utils/io_util.rb +2 -2
  290. data/lib/contrast/utils/job_servers_running.rb +10 -5
  291. data/lib/contrast/utils/object_share.rb +1 -1
  292. data/lib/contrast/utils/os.rb +3 -2
  293. data/lib/contrast/utils/preflight_util.rb +1 -1
  294. data/lib/contrast/utils/resource_loader.rb +1 -1
  295. data/lib/contrast/utils/ruby_ast_rewriter.rb +3 -2
  296. data/lib/contrast/utils/sha256_builder.rb +1 -1
  297. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  298. data/lib/contrast/utils/string_utils.rb +1 -1
  299. data/lib/contrast/utils/tag_util.rb +1 -1
  300. data/lib/contrast/utils/thread_tracker.rb +1 -1
  301. data/lib/contrast/utils/timer.rb +1 -1
  302. data/resources/assess/policy.json +8 -11
  303. data/resources/deadzone/policy.json +7 -17
  304. data/ruby-agent.gemspec +66 -27
  305. data/service_executables/VERSION +1 -1
  306. data/service_executables/linux/contrast-service +0 -0
  307. data/service_executables/mac/contrast-service +0 -0
  308. data/sonar-project.properties +9 -0
  309. metadata +154 -156
  310. data/lib/contrast/agent/assess/rule.rb +0 -18
  311. data/lib/contrast/agent/assess/rule/base.rb +0 -52
  312. data/lib/contrast/agent/assess/rule/redos.rb +0 -67
  313. data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +0 -38
  314. data/lib/contrast/common_agent_configuration.rb +0 -87
  315. data/lib/contrast/framework/sinatra/patch/base.rb +0 -83
  316. data/lib/contrast/framework/sinatra/patch/support.rb +0 -27
  317. data/lib/contrast/utils/prevent_serialization.rb +0 -52
@@ -1,18 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Assess
7
- # This is the base module for our assess rule classes. It is intended to
8
- # facilitate the patching of the application for Assess functionality. Any
9
- # class under this namespace should be required here, providing a single
10
- # point of require for this functionality.
11
- module Rule
12
- end
13
- end
14
- end
15
- end
16
-
17
- require 'contrast/agent/assess/rule/base'
18
- require 'contrast/agent/assess/rule/provider'
@@ -1,52 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'digest'
5
- require 'zlib'
6
- require 'contrast/components/interface'
7
-
8
- module Contrast
9
- module Agent
10
- module Assess
11
- module Rule
12
- # The base class for each of our Assess Rules
13
- class Base
14
- include Contrast::Components::Interface
15
- access_component :agent, :analysis, :logging, :settings
16
-
17
- def initialize
18
- SETTINGS.assess_rules[name] = self
19
- end
20
-
21
- # Should return the name as it is known to Teamserver; defaults to
22
- # class
23
- def name
24
- cs__class.name
25
- end
26
-
27
- def enabled?
28
- ASSESS.enabled? && !ASSESS.rule_disabled?(name)
29
- end
30
-
31
- def prefilter _context; end
32
-
33
- # If a rule needs to inspect the response body it is not stream safe
34
- # The rule should override this and return false
35
- def stream_safe?
36
- true
37
- end
38
-
39
- def postfilter _context; end
40
-
41
- # this rule is excluded if any of the given exclusions have a
42
- # protection rule that matches this rule name
43
- def excluded? exclusions
44
- Array(exclusions).any? do |ex|
45
- ex.assess_rule?(name)
46
- end
47
- end
48
- end
49
- end
50
- end
51
- end
52
- end
@@ -1,67 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Assess
7
- module Rule
8
- # A regexp is only vulnerable to REDOS if it's going to run
9
- # with pathologically bad performance.
10
- # We report a vulnerability if the regexp is liable to run
11
- # with quadratic time for some input.
12
- # This vastly errs on the side of false positives.
13
- class Redos < Contrast::Agent::Assess::Rule::Base
14
- class << self
15
- NAME = 'redos'
16
- def name
17
- NAME
18
- end
19
-
20
- def regexp_complexity_check context, trigger_node, source, object, ret, *args
21
- # we can arrive here either from:
22
- # regexp =~ string
23
- # string =~ regexp
24
- # regexp.match string
25
- #
26
- # so object/args[0] can be string/regexp or regexp/string.
27
- regexp = object.is_a?(Regexp) ? object : args[0]
28
- string = object.is_a?(String) ? object : args[0]
29
-
30
- # (1) regexp must be exploitable
31
- return unless regexp_vulnerable?(regexp)
32
-
33
- # (2) regexp must evaluate against user input
34
- return unless trigger_node.violated?(string)
35
-
36
- Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, *args)
37
- end
38
-
39
- protected
40
-
41
- VULNERABLE_PATTERN = /[\[(].*?[\[(].*?[\])][*+?].*?[\])][*+?]/.cs__freeze
42
-
43
- # Does the regexp
44
- # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/redos.md
45
- def regexp_vulnerable? regexp
46
- # A pattern is considered vulnerable if it has 2 or more levels of nested multi-matching.
47
- # A level is defined as any set of opening and closing control characters immediately followed by a multi match control character.
48
- # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS,
49
- # or MULTI_MATCH_CHARS that is not immediately preceded by an escaping \ character.
50
- # OPENING_CHARS are ( and [ CLOSING_CHARS are ) and ] MULTI_MATCH_CHARS are +, *, and ?
51
-
52
- # Nota bene about Regexp#to_s: it doesn't necessarily give you the original Regexp back
53
- # (in the sense of `my_str == Regexp.new(my_str).to_s`), it gives you a Regexp that
54
- # will have the same functional characteristics as the original.
55
- # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
56
- # Regexp#source will give you the original source.
57
-
58
- # Use #match? because it doesn't fill out global variables
59
- # in the way match or =~ do.
60
- VULNERABLE_PATTERN.match? regexp.source
61
- end
62
- end
63
- end
64
- end
65
- end
66
- end
67
- end
@@ -1,38 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Agent
6
- module Inventory
7
- # Keeps a map of gem digest to files for reporting file usage
8
- class GemfileDigestCache
9
- extend Forwardable
10
- def_delegator :@gem_spec_digest_to_files,
11
- :empty?
12
-
13
- def initialize
14
- @gem_spec_digest_to_files = {}
15
- end
16
-
17
- def generate_usage_data activity
18
- return unless activity
19
-
20
- @gem_spec_digest_to_files.each_pair do |digest, files|
21
- usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
22
- activity.library_usages[usage.hash_code] = usage if activity
23
- end
24
- @gem_spec_digest_to_files.clear
25
- end
26
-
27
- def use_cache digest
28
- yield get(digest)
29
- end
30
-
31
- def get digest
32
- @gem_spec_digest_to_files[digest] = Set.new unless @gem_spec_digest_to_files.key?(digest)
33
- @gem_spec_digest_to_files[digest]
34
- end
35
- end
36
- end
37
- end
38
- end
@@ -1,87 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- # rubocop:disable Style/MissingRespondToMissing
5
- module Contrast
6
- # A wrapper build around the Common Agent Configuration project to allow for
7
- # access of the values contained in its parent_configuration_spec.yaml
8
- class CommonAgentConfiguration
9
- # The CAC spec, deserialized to a hash.
10
-
11
- SPEC = 'spec'
12
- NODES = 'nodes'
13
- PROPERTIES = 'properties'
14
-
15
- def initialize hsh
16
- @hsh = hsh[SPEC]
17
- end
18
-
19
- # Used to indicate those sections of the configuration which have
20
- # references to other nodes or properties, allowing for the parsing of and
21
- # access to the nested configuration structure.
22
- module IsANode
23
- def children
24
- hsh[NODES]&.map { |raw_node| Node.new(raw_node) } || []
25
- end
26
-
27
- def properties
28
- hsh[PROPERTIES].map { |raw_property| Property.new(raw_property) }
29
- end
30
-
31
- def lookup *path
32
- # Path will be N args, representing a path of nodes.
33
- path.reduce(self) do |node, next_arg|
34
- # If we can travel to a node by that name, do that.
35
- candidate_node = node.children.find { |n| n.name == next_arg }
36
- next candidate_node if candidate_node
37
-
38
- # If there's a property, dereference that.
39
- candidate_property = node.properties.find { |n| n.name == next_arg }
40
- next candidate_property if candidate_property
41
-
42
- raise IndexError, "couldn't traverse path:\t#{ path.join(Contrast::Utils::ObjectShare::PERIOD) }"
43
- end
44
- end
45
-
46
- def method_missing method, *args, &block
47
- if args.any?
48
- lookup(method.to_s).public_send(args, block)
49
- else
50
- lookup(method.to_s)
51
- end
52
- rescue IndexError
53
- super(method, args, block)
54
- end
55
- end
56
-
57
- # Used to indicate those sections of the configuration which are for a
58
- # single property, allowing for the parsing of and access to the
59
- # information describing the property.
60
- module IsAProperty
61
- attr_reader :hsh
62
-
63
- def initialize hsh
64
- @hsh = hsh
65
- end
66
-
67
- %w[name default description required_languages display].each do |field|
68
- # TODO: RUBY-1052
69
- define_method(field) { hsh[field].dup } # rubocop:disable Performance/Kernel/DefineMethod
70
- end
71
- end
72
-
73
- include IsANode
74
- include IsAProperty
75
-
76
- # A Property in the Common Agent Configuration
77
- class Property
78
- include IsAProperty
79
- end
80
-
81
- # A Node in the Common Agent Configuration
82
- class Node < Property
83
- include IsANode
84
- end
85
- end
86
- end
87
- # rubocop:enable Style/MissingRespondToMissing
@@ -1,83 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/framework/sinatra/support'
5
-
6
- module Contrast
7
- module Framework
8
- module Sinatra
9
- module Patch
10
- # Our patch into the Sinatra::Base Class, allowing for the inventory of the
11
- # routes called by the application
12
- module Base
13
- class << self
14
- # Use logic copied from Sinatra::Base#process_route to determine which
15
- # pattern matches the request being invoked by Sinatra::Base#call!
16
- #
17
- # @param clazz [Class] the Class that extends Sinatra::Base in
18
- # which this route is defined.
19
- # @param settings [Object] the Sinatra::Base @settings object.
20
- # @param args [Array<Object>] we rely on the @settings object in
21
- # Sinatra::Base and the env variable passed in as args[0].
22
- def map_route clazz, settings, *args
23
- context = Contrast::Agent::REQUEST_TRACKER.current
24
- return unless context
25
-
26
- env = args[0]
27
- return unless env
28
- return unless settings
29
-
30
- convert_routes(context, clazz, settings, env)
31
- rescue StandardError
32
- # Being careful here since we're directly patching something
33
- end
34
-
35
- def instrument
36
- @_instrument ||= begin
37
- ::Sinatra::Base.class_eval do
38
- alias_method :cs__patched_sinatra_base_call!, :call!
39
- # publicly available method for Sinatra::Base things -- unfortunately,
40
- # getting the routes appear to require a lookup every time
41
- def call! *args
42
- Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
43
- cs__patched_sinatra_base_call!(*args)
44
- end
45
- end
46
- true
47
- end
48
- end
49
-
50
- private
51
-
52
- # Find the route that matches this request. Since we're using
53
- # settings, we should resolve in the same precedence as Sinatra
54
- def convert_routes context, clazz, settings, env
55
- # There isn't a Request object in the Sinatra::Base yet - it's made
56
- # during the #call! method, which we're patching - so we need to
57
- # access the env
58
- method = env[::Rack::REQUEST_METHOD]
59
- # get all potential routes for this request type
60
- routes = settings.routes[method]
61
- return unless routes
62
-
63
- route = env[::Rack::PATH_INFO]
64
- route = route.to_s
65
-
66
- # Do some cleanup that matches Sinatra::Base#process_route
67
- route = '/' if route.empty? && !settings.empty_path_info?
68
- route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
69
-
70
- routes.each do |pattern, _, _| # Mustermann::Sinatra
71
- next unless pattern.params(route)
72
-
73
- dtm = Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, pattern)
74
- context.append_route_coverage(dtm)
75
- break
76
- end
77
- end
78
- end
79
- end
80
- end
81
- end
82
- end
83
- end
@@ -1,27 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/agent/patching/policy/after_load_patch'
5
-
6
- module Contrast
7
- module Framework
8
- module Sinatra
9
- module Patch
10
- # Extension point allowing for the registration of Patches required to
11
- # support the Sinatra framework.
12
- module Support
13
- # (See BaseSupport#after_load_patches)
14
- def after_load_patches
15
- Set.new([
16
- Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
17
- 'Sinatra::Base',
18
- 'contrast/framework/sinatra/patch/base',
19
- method_to_instrument: nil,
20
- instrumenting_module: 'Contrast::Framework::Sinatra::Patch::Base')
21
- ])
22
- end
23
- end
24
- end
25
- end
26
- end
27
- end
@@ -1,52 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Utils
6
- # DO NOT REMOVE THIS!
7
- #
8
- # Marshal is pretty cool. It does a lot of things well. What it doesn't
9
- # mess around with though is StringIO. And what we don't want to do is
10
- # serialize ourselves out with Marshal.dump.
11
- #
12
- # Unfortunately, we have to mess around w/ that. To isolate our things from
13
- # user dumped Strings (and so that we can marshal findings), we have
14
- # decided to make this class not marshalled.
15
- module PreventMarshalSerialization
16
- def marshal_dump
17
- nil
18
- end
19
-
20
- def marshal_load *_args
21
- nil
22
- end
23
- end
24
-
25
- # DO NOT REMOVE THIS!
26
- #
27
- # Psych/YAML is also pretty cool. But it doesn't mess with anonymous
28
- # classes. In order to make things we extend serializable, we need to make
29
- # sure we play nice.
30
- module PreventPsychSerialization
31
- def encode_with *_args
32
- nil
33
- end
34
-
35
- def init_with *_args
36
- nil
37
- end
38
- end
39
-
40
- # DO NOT REMOVE THIS!
41
- #
42
- # This module is used to prevent deserialization of our classes, not b/c
43
- # we're trying to be sneaky, but b/c there is a high probability that the
44
- # events we're capturing have non-serializable data in them and b/c we
45
- # can't be sure the serialized data will be used in an application running
46
- # Contrast.
47
- module PreventSerialization
48
- include PreventMarshalSerialization
49
- include PreventPsychSerialization
50
- end
51
- end
52
- end