contrast-agent 4.4.0 → 4.8.0

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/tracker'
@@ -53,8 +53,7 @@ module Contrast
             idx += 1
             if Contrast::Utils::DuckUtils.iterable_hash?(obj)
               obj.each_pair do |k, v|
-                return true if _tracked?(k, idx)
-                return true if _tracked?(v, idx)
+                return true if _tracked?(k, idx) || _tracked?(v, idx)
               end
               false
             elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)

data/lib/contrast/utils/class_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/extension/module'
@@ -9,14 +9,6 @@ module Contrast
     # Utility methods for exploring the complete space of Objects
     class ClassUtil
       class << self
-        # Given a module, return all of its descendants
-        #
-        # @param mod [Module] the module whose descendants you want to find.
-        # @return [Array<Module>] those Modules that inherit from the given.
-        def descendants mod
-          ObjectSpace.each_object(mod).to_a
-        end
-
         # some classes have had things prepended to them, like Marshal in Rails
         # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
         # our alias patching approach, as will any other prepend on something
@@ -67,12 +59,12 @@ module Contrast
             Contrast::Utils::ObjectShare::NIL_STRING
           elsif object.cs__is_a?(Symbol)
             ":#{ object }"
-          elsif object.cs__is_a?(Numeric)
-            object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
           elsif object.cs__is_a?(Regexp)
             object.source
+          elsif use_to_s?(object)
+            object.to_s
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -108,6 +100,18 @@ module Contrast
 
         private
 
+        # Some objects have nice to_s that we can use to make them human readable. If they do, we should leverage them.
+        # We used to do this by default, but this opened us up to danger, so we're instead using an allow list approach.
+        #
+        # @param object [Object] something that may have a safe to_s method
+        # @return [Boolean] if we should invoke to_s to represent the object
+        def use_to_s? object
+          return true if object.cs__is_a?(Numeric)
+          return true if defined?(Arel::Nodes::SqlLiteral) && object.cs__is_a?(Arel::Nodes::SqlLiteral)
+
+          false
+        end
+
         def determine_target_class mod, is_instance
           return mod if mod.singleton_class?
 

data/lib/contrast/utils/duck_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/env_configuration_item.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/hash_digest.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'digest'
@@ -15,10 +15,7 @@ module Contrast
       include Digest::Instance
 
       CONTENT_LENGTH_HEADER = 'Content-Length'
-      CRYPTO_RULES = %w[
-        crypto-bad-ciphers
-        crypto-bad-mac
-      ].cs__freeze
+      CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
       CONFIG_PATH_KEY = 'path'
       CONFIG_SESSION_ID_KEY = 'sessionId'
       CLASS_SOURCE_KEY = 'source'
@@ -37,13 +34,13 @@ module Contrast
           hash.finish
         end
 
-        def generate_event_hash finding, source
-          return generate_dataflow_hash(finding) if finding.events.length.to_i > 1
+        def generate_event_hash finding, source, request
+          return generate_dataflow_hash(finding, request) if finding.events.length.to_i > 1
 
           id = finding.rule_id
-          return generate_crypto_hash(finding, source) if CRYPTO_RULES.include?(id)
+          return generate_crypto_hash(finding, source, request) if CRYPTO_RULES.include?(id)
 
-          generate_trigger_hash(finding)
+          generate_trigger_hash(finding, request)
         end
 
         def generate_config_hash finding
@@ -71,40 +68,35 @@ module Contrast
 
         private
 
-        def generate_crypto_hash finding, algorithm
+        def generate_crypto_hash finding, algorithm, request
           hash = new
           hash.update(finding.rule_id)
           hash.update(algorithm)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
 
-        def generate_dataflow_hash finding
+        def generate_dataflow_hash finding, request
           hash = new
           hash.update(finding.rule_id)
           hash.update_on_sources(finding.events)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
 
-        def generate_trigger_hash finding
+        def generate_trigger_hash finding, request
           hash = new
           hash.update(finding.rule_id)
-          hash.update_on_request
+          hash.update_on_request(finding, request)
           hash.finish
         end
       end
 
-      def update_on_request
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context
-
-        route = context.route
-        request = context.request
-        if route
+      def update_on_request finding, request
+        if (route = finding.routes[0])
           update(route.route)
           update(route.verb)
-        elsif request
+        elsif request ||= Contrast::Agent::REQUEST_TRACKER.current&.request
           update(request.normalized_uri)
           update(request.request_method)
         end
@@ -116,7 +108,7 @@ module Contrast
         events.each do |event|
           event.event_sources.each do |source|
             update(source.type)
-            update(source.name)
+            update(source.name) # rubocop:disable Security/Module/Name -- API attribute.
           end
         end
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'objspace'

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/trigger_method'

data/lib/contrast/utils/inventory_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/timer'

data/lib/contrast/utils/io_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -20,7 +20,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.cs__name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -24,12 +24,17 @@ module Contrast
         end
 
         def rake_running?
-          return unless defined?(Rake) &&
-              Rake.cs__respond_to?(:application) &&
-              Rake.application.cs__respond_to?(:top_level_tasks)
+          unless defined?(Rake) &&
+                Rake.cs__respond_to?(:application) &&
+                Rake.application.cs__respond_to?(:top_level_tasks)
+
+            return
+          end
 
           disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
-          has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
+          has_disabled_task = Rake.application.top_level_tasks.any? do |top_level_task|
+            disabled_rake_tasks.include?(top_level_task)
+          end
           return false unless has_disabled_task
 
           logger.trace('Detected startup within Rake task')

data/lib/contrast/utils/object_share.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # rubocop:disable Security/Object/Freeze

data/lib/contrast/utils/os.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
@@ -27,7 +27,8 @@ module Contrast
         # returns an array of zombie process PIDs as strings; empty array if there are none
         def zombie_pids
           with_contrast_scope do
-            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
+            # retrieve pid of service processes
+            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'`
             zombie_pid_list.split("\n")
           end
         end

data/lib/contrast/utils/preflight_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/resource_loader.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'parser/current'
+return unless RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
 
+require 'parser/current'
 module Contrast
   module Utils
     # This utility allows us to parse and rewrite the AST in Ruby 2.5,

data/lib/contrast/utils/sha256_builder.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'singleton'

data/lib/contrast/utils/stack_trace_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/utils/object_share'

data/lib/contrast/utils/string_utils.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/components/interface'

data/lib/contrast/utils/tag_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/thread_tracker.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/utils/timer.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/resources/assess/policy.json

@@ -1026,6 +1026,61 @@
        "action": "CUSTOM",
        "patch_class": "ERBPropagator",
        "patch_method": "result_tagger"
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "strip_tags",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rack::Protection::EscapedParams",
+      "method_name": "escape_string",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::RackProtection",
+      "patch_method": "escaped_params"
+    },
+    {
+      "class_name": "Rails::Html::FullSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rails::Html::SafeListSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
     }
   ],
   "rules":[
@@ -1174,7 +1229,6 @@
           "method_visibility": "public",
           "method_name":"match",
           "source":"P0"
-
         }, {
           "class_name":"String",
           "instance_method": true,
@@ -1187,7 +1241,6 @@
           "method_visibility": "public",
           "method_name":"=~",
           "source":"P0"
-
         }
       ]
     }, {
@@ -1423,6 +1476,11 @@
           "instance_method": true,
           "method_visibility": "public",
           "method_name":"rand"
+        }, {
+          "class_name":"Random::Base",
+          "instance_method": true,
+          "method_visibility": "public",
+          "method_name":"rand"
         }
       ]
     }, {

data/resources/deadzone/policy.json

@@ -5,16 +5,6 @@
       "instance_method":true,
       "method_visibility": "public",
       "method_name":"content_type"
-    }, {
-      "class_name":"Rack::Request::Helpers",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"host_authority"
-    }, {
-      "class_name":"Rack::Request::Helpers",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"host_with_port"
     }, {
       "class_name":"Rack::Request::Helpers",
       "instance_method":true,
@@ -61,18 +51,18 @@
       "method_visibility": "private",
       "method_name":"session_exists?",
       "code": "https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L334"
-    }, {
-      "class_name":"ActionDispatch::Http::MimeNegotiation",
-      "instance_method":true,
-      "method_visibility": "public",
-      "method_name":"formats",
-      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
     }, {
       "class_name":"ActionDispatch::FileHandler",
       "instance_method":true,
       "method_visibility": "public",
       "method_name":"match?",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/middleware/static.rb#L30"
+    }, {
+      "class_name":"ActionDispatch::Http::MimeNegotiation",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"formats",
+      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L63"
     }, {
       "class_name":"ActionDispatch::Journey::Router",
       "instance_method":true,
@@ -83,7 +73,7 @@
       "class_name":"ActionDispatch::Request",
       "instance_method":true,
       "method_visibility": "public",
-      "method_name":"controler_class_for",
+      "method_name":"controller_class_for",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/http/request.rb#L84"
     }, {
       "class_name":"ActionDispatch::Request",
@@ -205,12 +195,6 @@
       "method_visibility": "public",
       "method_name":"exists?",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
-    }, {
-      "class_name":"ActionView::Template",
-      "instance_method":true,
-      "method_visibility": "private",
-      "method_name":"method_name",
-      "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionview/lib/action_view/template.rb#L368"
     }
   ]
 }