contrast-agent 4.4.1 → 4.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (309) hide show
  1. checksums.yaml +4 -4
  2. data/.simplecov +1 -1
  3. data/Gemfile +1 -1
  4. data/LICENSE.txt +1 -1
  5. data/Rakefile +1 -1
  6. data/exe/contrast_service +1 -1
  7. data/ext/build_funchook.rb +1 -1
  8. data/ext/cs__assess_active_record_named/cs__active_record_named.c +1 -1
  9. data/ext/cs__assess_active_record_named/extconf.rb +1 -1
  10. data/ext/cs__assess_array/cs__assess_array.c +1 -1
  11. data/ext/cs__assess_array/extconf.rb +1 -1
  12. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +1 -1
  13. data/ext/cs__assess_basic_object/extconf.rb +1 -1
  14. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +1 -1
  15. data/ext/cs__assess_fiber_track/extconf.rb +1 -1
  16. data/ext/cs__assess_hash/cs__assess_hash.c +4 -2
  17. data/ext/cs__assess_hash/extconf.rb +1 -1
  18. data/ext/cs__assess_kernel/cs__assess_kernel.c +1 -1
  19. data/ext/cs__assess_kernel/extconf.rb +1 -1
  20. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +1 -1
  21. data/ext/cs__assess_marshal_module/extconf.rb +1 -1
  22. data/ext/cs__assess_module/cs__assess_module.c +1 -1
  23. data/ext/cs__assess_module/extconf.rb +1 -1
  24. data/ext/cs__assess_regexp/cs__assess_regexp.c +1 -1
  25. data/ext/cs__assess_regexp/extconf.rb +1 -1
  26. data/ext/cs__assess_string/cs__assess_string.c +1 -1
  27. data/ext/cs__assess_string/extconf.rb +1 -1
  28. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -1
  29. data/ext/cs__assess_string_interpolation26/extconf.rb +1 -1
  30. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -1
  31. data/ext/cs__assess_yield_track/extconf.rb +1 -1
  32. data/ext/cs__common/cs__common.c +5 -5
  33. data/ext/cs__common/cs__common.h +4 -4
  34. data/ext/cs__common/extconf.rb +1 -1
  35. data/ext/cs__contrast_patch/cs__contrast_patch.c +22 -25
  36. data/ext/cs__contrast_patch/extconf.rb +1 -1
  37. data/ext/cs__protect_kernel/cs__protect_kernel.c +1 -1
  38. data/ext/cs__protect_kernel/extconf.rb +1 -1
  39. data/ext/extconf_common.rb +1 -1
  40. data/lib/contrast-agent.rb +1 -1
  41. data/lib/contrast.rb +20 -1
  42. data/lib/contrast/agent.rb +1 -1
  43. data/lib/contrast/agent/assess.rb +1 -1
  44. data/lib/contrast/agent/assess/contrast_event.rb +54 -69
  45. data/lib/contrast/agent/assess/contrast_object.rb +1 -1
  46. data/lib/contrast/agent/assess/events/event_factory.rb +1 -1
  47. data/lib/contrast/agent/assess/events/source_event.rb +7 -2
  48. data/lib/contrast/agent/assess/finalizers/freeze.rb +1 -1
  49. data/lib/contrast/agent/assess/finalizers/hash.rb +26 -34
  50. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +20 -19
  51. data/lib/contrast/agent/assess/policy/patcher.rb +1 -1
  52. data/lib/contrast/agent/assess/policy/policy.rb +1 -1
  53. data/lib/contrast/agent/assess/policy/policy_node.rb +1 -1
  54. data/lib/contrast/agent/assess/policy/policy_scanner.rb +1 -1
  55. data/lib/contrast/agent/assess/policy/preshift.rb +1 -1
  56. data/lib/contrast/agent/assess/policy/propagation_method.rb +2 -6
  57. data/lib/contrast/agent/assess/policy/propagation_node.rb +1 -1
  58. data/lib/contrast/agent/assess/policy/propagator.rb +1 -1
  59. data/lib/contrast/agent/assess/policy/propagator/append.rb +1 -1
  60. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  61. data/lib/contrast/agent/assess/policy/propagator/center.rb +1 -1
  62. data/lib/contrast/agent/assess/policy/propagator/custom.rb +1 -1
  63. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +1 -1
  64. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -1
  65. data/lib/contrast/agent/assess/policy/propagator/keep.rb +1 -1
  66. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +1 -1
  67. data/lib/contrast/agent/assess/policy/propagator/next.rb +1 -1
  68. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +1 -1
  69. data/lib/contrast/agent/assess/policy/propagator/remove.rb +1 -1
  70. data/lib/contrast/agent/assess/policy/propagator/replace.rb +1 -1
  71. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +1 -1
  72. data/lib/contrast/agent/assess/policy/propagator/select.rb +1 -1
  73. data/lib/contrast/agent/assess/policy/propagator/splat.rb +1 -1
  74. data/lib/contrast/agent/assess/policy/propagator/split.rb +1 -1
  75. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +1 -1
  76. data/lib/contrast/agent/assess/policy/propagator/trim.rb +1 -1
  77. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +1 -1
  78. data/lib/contrast/agent/assess/policy/source_method.rb +87 -76
  79. data/lib/contrast/agent/assess/policy/source_node.rb +1 -1
  80. data/lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb +8 -6
  81. data/lib/contrast/agent/assess/policy/source_validation/source_validation.rb +1 -1
  82. data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +3 -3
  83. data/lib/contrast/agent/assess/policy/trigger/xpath.rb +7 -8
  84. data/lib/contrast/agent/assess/policy/trigger_method.rb +99 -62
  85. data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -3
  86. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
  87. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  88. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +1 -1
  89. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -1
  90. data/lib/contrast/agent/assess/properties.rb +1 -1
  91. data/lib/contrast/agent/assess/property/evented.rb +1 -1
  92. data/lib/contrast/agent/assess/property/tagged.rb +1 -1
  93. data/lib/contrast/agent/assess/property/updated.rb +1 -1
  94. data/lib/contrast/agent/assess/rule/provider.rb +1 -1
  95. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +1 -1
  96. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +1 -1
  97. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +1 -1
  98. data/lib/contrast/agent/assess/tag.rb +1 -1
  99. data/lib/contrast/agent/assess/tracker.rb +1 -1
  100. data/lib/contrast/agent/at_exit_hook.rb +1 -1
  101. data/lib/contrast/agent/class_reopener.rb +1 -1
  102. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +1 -1
  103. data/lib/contrast/agent/deadzone/policy/policy.rb +1 -1
  104. data/lib/contrast/agent/disable_reaction.rb +1 -1
  105. data/lib/contrast/agent/exclusion_matcher.rb +1 -1
  106. data/lib/contrast/agent/inventory.rb +1 -2
  107. data/lib/contrast/agent/inventory/dependencies.rb +1 -1
  108. data/lib/contrast/agent/inventory/dependency_analysis.rb +1 -1
  109. data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +35 -23
  110. data/lib/contrast/agent/inventory/policy/datastores.rb +1 -1
  111. data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
  112. data/lib/contrast/agent/inventory/policy/trigger_node.rb +1 -1
  113. data/lib/contrast/agent/middleware.rb +8 -9
  114. data/lib/contrast/agent/module_data.rb +1 -1
  115. data/lib/contrast/agent/patching/policy/after_load_patch.rb +1 -1
  116. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +1 -1
  117. data/lib/contrast/agent/patching/policy/method_policy.rb +1 -1
  118. data/lib/contrast/agent/patching/policy/module_policy.rb +1 -1
  119. data/lib/contrast/agent/patching/policy/patch.rb +8 -6
  120. data/lib/contrast/agent/patching/policy/patch_status.rb +1 -1
  121. data/lib/contrast/agent/patching/policy/patcher.rb +8 -10
  122. data/lib/contrast/agent/patching/policy/policy.rb +1 -1
  123. data/lib/contrast/agent/patching/policy/policy_node.rb +1 -1
  124. data/lib/contrast/agent/patching/policy/trigger_node.rb +1 -1
  125. data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +1 -1
  126. data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb +1 -1
  127. data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
  128. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +1 -1
  129. data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -1
  130. data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
  131. data/lib/contrast/agent/protect/policy/policy.rb +1 -1
  132. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  133. data/lib/contrast/agent/protect/policy/trigger_node.rb +1 -1
  134. data/lib/contrast/agent/protect/rule.rb +1 -1
  135. data/lib/contrast/agent/protect/rule/base.rb +7 -18
  136. data/lib/contrast/agent/protect/rule/base_service.rb +2 -2
  137. data/lib/contrast/agent/protect/rule/cmd_injection.rb +2 -2
  138. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  139. data/lib/contrast/agent/protect/rule/deserialization.rb +1 -1
  140. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +1 -1
  141. data/lib/contrast/agent/protect/rule/no_sqli.rb +2 -2
  142. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -1
  143. data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -1
  144. data/lib/contrast/agent/protect/rule/sqli.rb +2 -2
  145. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +1 -1
  146. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +1 -1
  147. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +2 -2
  148. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +1 -1
  149. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +1 -1
  150. data/lib/contrast/agent/protect/rule/xss.rb +1 -1
  151. data/lib/contrast/agent/protect/rule/xxe.rb +1 -1
  152. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +1 -1
  153. data/lib/contrast/agent/railtie.rb +1 -1
  154. data/lib/contrast/agent/reaction_processor.rb +1 -1
  155. data/lib/contrast/agent/request.rb +2 -1
  156. data/lib/contrast/agent/request_context.rb +5 -10
  157. data/lib/contrast/agent/request_handler.rb +1 -1
  158. data/lib/contrast/agent/response.rb +1 -1
  159. data/lib/contrast/agent/rewriter.rb +1 -1
  160. data/lib/contrast/agent/rule_set.rb +3 -3
  161. data/lib/contrast/agent/scope.rb +1 -1
  162. data/lib/contrast/agent/service_heartbeat.rb +1 -1
  163. data/lib/contrast/agent/static_analysis.rb +1 -1
  164. data/lib/contrast/agent/thread.rb +1 -1
  165. data/lib/contrast/agent/thread_watcher.rb +1 -1
  166. data/lib/contrast/agent/tracepoint_hook.rb +1 -1
  167. data/lib/contrast/agent/version.rb +2 -2
  168. data/lib/contrast/agent/worker_thread.rb +1 -1
  169. data/lib/contrast/api.rb +1 -1
  170. data/lib/contrast/api/communication.rb +1 -1
  171. data/lib/contrast/api/communication/connection_status.rb +1 -1
  172. data/lib/contrast/api/communication/messaging_queue.rb +1 -1
  173. data/lib/contrast/api/communication/response_processor.rb +1 -1
  174. data/lib/contrast/api/communication/service_lifecycle.rb +1 -1
  175. data/lib/contrast/api/communication/socket.rb +1 -1
  176. data/lib/contrast/api/communication/socket_client.rb +1 -1
  177. data/lib/contrast/api/communication/speedracer.rb +3 -3
  178. data/lib/contrast/api/communication/tcp_socket.rb +1 -1
  179. data/lib/contrast/api/communication/unix_socket.rb +1 -1
  180. data/lib/contrast/api/decorators.rb +1 -1
  181. data/lib/contrast/api/decorators/address.rb +1 -1
  182. data/lib/contrast/api/decorators/agent_startup.rb +1 -1
  183. data/lib/contrast/api/decorators/application_settings.rb +1 -1
  184. data/lib/contrast/api/decorators/application_startup.rb +4 -2
  185. data/lib/contrast/api/decorators/application_update.rb +1 -1
  186. data/lib/contrast/api/decorators/http_request.rb +1 -1
  187. data/lib/contrast/api/decorators/input_analysis.rb +1 -1
  188. data/lib/contrast/api/decorators/instrumentation_mode.rb +37 -0
  189. data/lib/contrast/api/decorators/library.rb +1 -1
  190. data/lib/contrast/api/decorators/library_usage_update.rb +1 -1
  191. data/lib/contrast/api/decorators/message.rb +1 -1
  192. data/lib/contrast/api/decorators/rasp_rule_sample.rb +1 -1
  193. data/lib/contrast/api/decorators/route_coverage.rb +1 -1
  194. data/lib/contrast/api/decorators/server_features.rb +1 -1
  195. data/lib/contrast/api/decorators/trace_event.rb +1 -1
  196. data/lib/contrast/api/decorators/trace_event_object.rb +1 -1
  197. data/lib/contrast/api/decorators/trace_event_signature.rb +1 -1
  198. data/lib/contrast/api/decorators/trace_taint_range.rb +1 -1
  199. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +1 -1
  200. data/lib/contrast/api/decorators/user_input.rb +1 -1
  201. data/lib/contrast/common_agent_configuration.rb +1 -1
  202. data/lib/contrast/components/agent.rb +1 -1
  203. data/lib/contrast/components/app_context.rb +1 -1
  204. data/lib/contrast/components/assess.rb +1 -1
  205. data/lib/contrast/components/config.rb +1 -1
  206. data/lib/contrast/components/contrast_service.rb +1 -1
  207. data/lib/contrast/components/heap_dump.rb +1 -1
  208. data/lib/contrast/components/interface.rb +1 -1
  209. data/lib/contrast/components/inventory.rb +1 -1
  210. data/lib/contrast/components/logger.rb +1 -1
  211. data/lib/contrast/components/protect.rb +4 -2
  212. data/lib/contrast/components/sampling.rb +1 -1
  213. data/lib/contrast/components/scope.rb +1 -1
  214. data/lib/contrast/components/settings.rb +2 -2
  215. data/lib/contrast/config.rb +1 -1
  216. data/lib/contrast/config/agent_configuration.rb +1 -1
  217. data/lib/contrast/config/application_configuration.rb +1 -1
  218. data/lib/contrast/config/assess_configuration.rb +1 -1
  219. data/lib/contrast/config/assess_rules_configuration.rb +1 -1
  220. data/lib/contrast/config/base_configuration.rb +1 -1
  221. data/lib/contrast/config/default_value.rb +1 -1
  222. data/lib/contrast/config/exception_configuration.rb +1 -1
  223. data/lib/contrast/config/heap_dump_configuration.rb +1 -1
  224. data/lib/contrast/config/inventory_configuration.rb +1 -1
  225. data/lib/contrast/config/logger_configuration.rb +1 -1
  226. data/lib/contrast/config/protect_configuration.rb +1 -1
  227. data/lib/contrast/config/protect_rule_configuration.rb +23 -1
  228. data/lib/contrast/config/protect_rules_configuration.rb +1 -1
  229. data/lib/contrast/config/root_configuration.rb +1 -1
  230. data/lib/contrast/config/ruby_configuration.rb +1 -1
  231. data/lib/contrast/config/sampling_configuration.rb +1 -1
  232. data/lib/contrast/config/server_configuration.rb +1 -1
  233. data/lib/contrast/config/service_configuration.rb +1 -1
  234. data/lib/contrast/configuration.rb +1 -1
  235. data/lib/contrast/delegators/input_analysis.rb +12 -0
  236. data/lib/contrast/extension/assess.rb +1 -1
  237. data/lib/contrast/extension/assess/array.rb +1 -1
  238. data/lib/contrast/extension/assess/erb.rb +1 -1
  239. data/lib/contrast/extension/assess/eval_trigger.rb +1 -5
  240. data/lib/contrast/extension/assess/exec_trigger.rb +1 -5
  241. data/lib/contrast/extension/assess/fiber.rb +1 -1
  242. data/lib/contrast/extension/assess/hash.rb +1 -1
  243. data/lib/contrast/extension/assess/kernel.rb +1 -1
  244. data/lib/contrast/extension/assess/marshal.rb +1 -5
  245. data/lib/contrast/extension/assess/regexp.rb +1 -1
  246. data/lib/contrast/extension/assess/string.rb +1 -1
  247. data/lib/contrast/extension/delegator.rb +1 -1
  248. data/lib/contrast/extension/inventory.rb +1 -1
  249. data/lib/contrast/extension/kernel.rb +1 -1
  250. data/lib/contrast/extension/module.rb +1 -1
  251. data/lib/contrast/extension/protect.rb +1 -1
  252. data/lib/contrast/extension/protect/kernel.rb +1 -1
  253. data/lib/contrast/extension/protect/psych.rb +1 -1
  254. data/lib/contrast/extension/thread.rb +1 -1
  255. data/lib/contrast/framework/base_support.rb +1 -1
  256. data/lib/contrast/framework/manager.rb +3 -3
  257. data/lib/contrast/framework/platform_version.rb +1 -1
  258. data/lib/contrast/framework/rack/patch/session_cookie.rb +1 -1
  259. data/lib/contrast/framework/rack/patch/support.rb +1 -1
  260. data/lib/contrast/framework/rack/support.rb +1 -1
  261. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -1
  262. data/lib/contrast/framework/rails/patch/assess_configuration.rb +1 -1
  263. data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +4 -4
  264. data/lib/contrast/framework/rails/patch/support.rb +1 -1
  265. data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +1 -1
  266. data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +1 -1
  267. data/lib/contrast/framework/rails/rewrite/active_record_named.rb +1 -1
  268. data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +1 -1
  269. data/lib/contrast/framework/rails/support.rb +1 -1
  270. data/lib/contrast/framework/sinatra/support.rb +1 -1
  271. data/lib/contrast/funchook/funchook.rb +1 -1
  272. data/lib/contrast/logger/application.rb +1 -1
  273. data/lib/contrast/logger/format.rb +1 -1
  274. data/lib/contrast/logger/log.rb +1 -1
  275. data/lib/contrast/logger/request.rb +1 -1
  276. data/lib/contrast/logger/time.rb +1 -1
  277. data/lib/contrast/security_exception.rb +1 -1
  278. data/lib/contrast/tasks/config.rb +1 -1
  279. data/lib/contrast/tasks/service.rb +1 -1
  280. data/lib/contrast/utils/assess/sampling_util.rb +1 -1
  281. data/lib/contrast/utils/assess/tracking_util.rb +1 -1
  282. data/lib/contrast/utils/class_util.rb +15 -3
  283. data/lib/contrast/utils/duck_utils.rb +1 -1
  284. data/lib/contrast/utils/env_configuration_item.rb +1 -1
  285. data/lib/contrast/utils/hash_digest.rb +14 -19
  286. data/lib/contrast/utils/heap_dump_util.rb +1 -1
  287. data/lib/contrast/utils/invalid_configuration_util.rb +1 -1
  288. data/lib/contrast/utils/inventory_util.rb +1 -1
  289. data/lib/contrast/utils/io_util.rb +1 -1
  290. data/lib/contrast/utils/job_servers_running.rb +1 -1
  291. data/lib/contrast/utils/object_share.rb +1 -1
  292. data/lib/contrast/utils/os.rb +1 -1
  293. data/lib/contrast/utils/preflight_util.rb +1 -1
  294. data/lib/contrast/utils/resource_loader.rb +1 -1
  295. data/lib/contrast/utils/ruby_ast_rewriter.rb +1 -1
  296. data/lib/contrast/utils/sha256_builder.rb +1 -1
  297. data/lib/contrast/utils/stack_trace_utils.rb +1 -1
  298. data/lib/contrast/utils/string_utils.rb +1 -1
  299. data/lib/contrast/utils/tag_util.rb +1 -1
  300. data/lib/contrast/utils/thread_tracker.rb +1 -1
  301. data/lib/contrast/utils/timer.rb +1 -1
  302. data/resources/assess/policy.json +5 -2
  303. data/resources/deadzone/policy.json +7 -17
  304. data/ruby-agent.gemspec +4 -5
  305. data/service_executables/VERSION +1 -1
  306. data/service_executables/linux/contrast-service +0 -0
  307. data/service_executables/mac/contrast-service +0 -0
  308. metadata +20 -33
  309. data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +0 -38
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/extension/module'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/cmd_injection'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/deserialization'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/no_sqli'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/path_traversal'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/sqli'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/xxe'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/patching/policy/policy'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/patching/policy/trigger_node'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -36,9 +36,9 @@ module Contrast
36
36
 
37
37
  attr_reader :mode
38
38
 
39
- def initialize default_mode = Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
39
+ def initialize
40
40
  PROTECT.rules[name] = self
41
- @mode = mode_from_settings || default_mode
41
+ @mode = mode_from_settings
42
42
  end
43
43
 
44
44
  # Should return the name as it is known to Teamserver; defaults to class
@@ -46,27 +46,16 @@ module Contrast
46
46
  cs__class.name
47
47
  end
48
48
 
49
- OFF = 'off'
50
-
51
49
  def enabled?
52
50
  # 1. it is not enabled because protect is not enabled
53
51
  return false unless AGENT.enabled?
54
52
  return false unless PROTECT.enabled?
55
53
 
56
- rule_configs = PROTECT.rule_config
57
- unless rule_configs.nil?
58
- # 2. it is not enabled because it is in the list of disabled protect rules
59
- disabled_rules = rule_configs.disabled_rules
60
- return false if disabled_rules&.include?(name)
61
-
62
- # 3. it is not enabled because it has been turned "off" explicitly
63
- rule_config = rule_configs.send(name)
64
-
65
- return rule_config.mode != OFF unless rule_config.mode.nil?
66
- end
54
+ # 2. it is not enabled because it is in the list of disabled protect rules
55
+ return false if PROTECT.rule_config&.disabled_rules&.include?(name)
67
56
 
68
- # 4. it is not enabled because it's mode is :NO_ACTION
69
- @mode != :NO_ACTION
57
+ # 3. it is enabled so long as its mode is not NO_ACTION
58
+ @mode != Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION
70
59
  end
71
60
 
72
61
  def excluded? exclusions
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -32,7 +32,7 @@ module Contrast
32
32
  # streamed responses will break
33
33
  def postfilter context
34
34
  return unless enabled? && POSTFILTER_MODES.include?(mode)
35
- return if mode == :NO_ACTION || mode == :PERMIT
35
+ return if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION || mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
36
36
 
37
37
  result = find_postfilter_attacker(context, nil)
38
38
  return unless result&.samples&.any?
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -47,7 +47,7 @@ module Contrast
47
47
  end
48
48
 
49
49
  def build_attack_with_match context, input_analysis_result, result, candidate_string, **kwargs
50
- return result if mode == :NO_ACTION || mode == :PERMIT
50
+ return result if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION || mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
51
51
 
52
52
  result ||= build_attack_result(context)
53
53
  update_successful_attack_response(context, input_analysis_result, result, candidate_string)
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  # The base class used to determine if a user input crosses a token boundary or
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -32,7 +32,7 @@ module Contrast
32
32
  end
33
33
 
34
34
  def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
35
- return result if mode == :NO_ACTION || mode == :PERMIT
35
+ return result if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION || mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
36
36
 
37
37
  attack_string = input_analysis_result.value
38
38
  regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -52,7 +52,7 @@ module Contrast
52
52
 
53
53
  result ||= build_attack_result(context)
54
54
  record_match(idx, length, boundary, last_boundary, kwargs)
55
- append_match(context, input_analysis_result, result, query_string, kwargs)
55
+ append_match(context, input_analysis_result, result, query_string, **kwargs)
56
56
  end
57
57
 
58
58
  result
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  # This class is the concrete implementation of the DefaultSqlScanner designed
@@ -1,7 +1,7 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
4
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
5
5
  # frozen_string_literal: true
6
6
 
7
7
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base_service'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/protect/rule/base'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/utils/job_servers_running'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/agent/disable_reaction'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'resolv'
@@ -27,6 +27,7 @@ module Contrast
27
27
  LAST_NUMBER_MARKER = '/{n}'
28
28
 
29
29
  attr_reader :rack_request
30
+ attr_accessor :route, :observed_route
30
31
 
31
32
  # Delegate calls to the following methods to the attribute @rack_request
32
33
  def_delegators :@rack_request, :base_url, :content_type, :cookies, :env, :ip, :path, :port, :query_string, :request_method, :scheme, :url, :user_agent
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/utils/timer'
@@ -6,6 +6,7 @@ require 'contrast/agent/request'
6
6
  require 'contrast/agent/response'
7
7
  require 'contrast/utils/inventory_util'
8
8
  require 'contrast/components/interface'
9
+ require 'contrast/delegators/input_analysis'
9
10
 
10
11
  module Contrast
11
12
  module Agent
@@ -30,15 +31,7 @@ module Contrast
30
31
 
31
32
  EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
32
33
 
33
- attr_reader :timer,
34
- :logging_hash,
35
- :speedracer_input_analysis,
36
- :request,
37
- :response,
38
- :activity,
39
- :server_activity,
40
- :route,
41
- :observed_route
34
+ attr_reader :activity, :logging_hash, :observed_route, :request, :response, :route, :speedracer_input_analysis, :server_activity, :timer
42
35
 
43
36
  def initialize rack_request, app_loaded = true
44
37
  with_contrast_scope do
@@ -107,6 +100,8 @@ module Contrast
107
100
  @observed_route.signature = route.route
108
101
  @observed_route.verb = route.verb
109
102
  @observed_route.url = route.url if route.url
103
+ @request.route = route
104
+ @request.observed_route = @observed_route
110
105
  end
111
106
 
112
107
  # Collect the results for the given rule with the given action
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'resolv'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  # intentional -- we're using a << operator here
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -16,7 +16,7 @@ module Contrast
16
16
  def prefilter
17
17
  context = Contrast::Agent::REQUEST_TRACKER.current
18
18
  # TODO: RUBY-801 We shouldn't be responsible for knowing what modes are enabled
19
- return unless context.analyze_request? || PROTECT.enabled?
19
+ return unless context&.analyze_request? || PROTECT.enabled?
20
20
 
21
21
  logger.trace_with_time('Running prefilter...') do
22
22
  map { |rule| rule.prefilter(context) }
@@ -33,7 +33,7 @@ module Contrast
33
33
  def postfilter
34
34
  context = Contrast::Agent::REQUEST_TRACKER.current
35
35
  # TODO: RUBY-801 We shouldn't be responsible for knowing what modes are enabled
36
- return unless context.analyze_response? || PROTECT.enabled?
36
+ return unless context&.analyze_response? || PROTECT.enabled?
37
37
 
38
38
  logger.trace_with_time('Running postfilter...') do
39
39
  map { |rule| rule.postfilter(context) }
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  module Contrast
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'
@@ -1,4 +1,4 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
1
+ # Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
4
  require 'contrast/components/interface'