contrast-agent 4.4.1 → 4.9.0

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'
@@ -10,7 +10,7 @@ module Contrast
         # Encapsulate common code for protect rules that do their
         # input analysis on Speedracer rather in ruby code
         class BaseService < Contrast::Agent::Protect::Rule::Base
-          def name
+          def rule_name
             'base-service'
           end
 
@@ -32,7 +32,11 @@ module Contrast
           # streamed responses will break
           def postfilter context
             return unless enabled? && POSTFILTER_MODES.include?(mode)
-            return if mode == :NO_ACTION || mode == :PERMIT
+            if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION ||
+                  mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+
+              return
+            end
 
             result = find_postfilter_attacker(context, nil)
             return unless result&.samples&.any?
@@ -40,14 +44,14 @@ module Contrast
             append_to_activity(context, result)
             return unless result.response == :BLOCKED
 
-            raise Contrast::SecurityException.new(self, "#{ name } triggered in postfilter. Response blocked.")
+            raise Contrast::SecurityException.new(self, "#{ rule_name } triggered in postfilter. Response blocked.")
           end
 
           protected
 
           def gather_ia_results context
             context.speedracer_input_analysis.results.select do |ia_result|
-              ia_result.rule_id == name
+              ia_result.rule_id == rule_name
             end
           end
 
@@ -58,7 +62,7 @@ module Contrast
 
           # Allows for the InputAnalysis from service to be extracted early
           def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
-            logger.trace('Checking vectors for attacks', rule: name, input: potential_attack_string)
+            logger.trace('Checking vectors for attacks', rule: rule_name, input: potential_attack_string)
 
             result = nil
             ia_results.each do |ia_result|

data/lib/contrast/agent/protect/rule/cmd_injection.rb

@@ -1,10 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
 require 'contrast/utils/stack_trace_utils'
 require 'contrast/utils/object_share'
-require 'contrast/components/interface'
+require 'contrast/components/logger'
 
 module Contrast
   module Agent
@@ -12,13 +12,12 @@ module Contrast
       module Rule
         # The Ruby implementation of the Protect Command Injection rule.
         class CmdInjection < Contrast::Agent::Protect::Rule::BaseService
-          include Contrast::Components::Interface
-          access_component :app_context, :logging
+          include Contrast::Components::Logger::InstanceMethods
 
           NAME = 'cmd-injection'
           CHAINED_COMMAND_CHARS = /[;&|<>]/.cs__freeze
 
-          def name
+          def rule_name
             NAME
           end
 
@@ -28,26 +27,31 @@ module Contrast
             ia_results = gather_ia_results(context)
             return if ia_results.empty?
 
-            if APP_CONTEXT.in_new_process?
+            if ::Contrast::APP_CONTEXT.in_new_process?
               logger.trace('Running cmd-injection infilter within new process - creating new context')
               context = Contrast::Agent::RequestContext.new(context.request.rack_request)
               Contrast::Agent::REQUEST_TRACKER.update_current_context(context)
             end
 
-            result = find_attacker_with_results(context, command, ia_results, **{ classname: classname, method: method })
+            result = find_attacker_with_results(context, command, ia_results,
+                                                **{ classname: classname, method: method })
             result ||= report_command_execution(context, command, **{ classname: classname, method: method })
             return unless result
 
             append_to_activity(context, result)
             return unless blocked?
 
-            raise Contrast::SecurityException.new(
-                self,
-                "Command Injection rule triggered. Call to #{ classname }.#{ method } blocked.")
+            raise Contrast::SecurityException.new(self,
+                                                  'Command Injection rule triggered. '\
+                                                  "Call to #{ classname }.#{ method } blocked.")
           end
 
           def build_attack_with_match context, input_analysis_result, result, candidate_string, **kwargs
-            return result if mode == :NO_ACTION || mode == :PERMIT
+            if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION ||
+                  mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+
+              return result
+            end
 
             result ||= build_attack_result(context)
             update_successful_attack_response(context, input_analysis_result, result, candidate_string)
@@ -60,14 +64,10 @@ module Contrast
           # Because results are not necessarily on the context across
           # processes; extract early and pass into the method
           def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
-            logger.trace('Checking vectors for attacks', rule: name, input: potential_attack_string)
+            logger.trace('Checking vectors for attacks', rule: rule_name, input: potential_attack_string)
             result = super(context, potential_attack_string, ia_results, **kwargs)
             if result.nil? && potential_attack_string
-              result = find_probable_attacker(
-                  context,
-                  potential_attack_string,
-                  ia_results,
-                  **kwargs)
+              result = find_probable_attacker(context, potential_attack_string, ia_results, **kwargs)
             end
             result
           end
@@ -109,12 +109,7 @@ module Contrast
             likely_attacker = ia_results.find { |input_analysis_result| chained_command?(input_analysis_result.value) }
             return unless likely_attacker
 
-            build_attack_with_match(
-                context,
-                likely_attacker,
-                nil,
-                potential_attack_string,
-                **kwargs)
+            build_attack_with_match(context, likely_attacker, nil, potential_attack_string, **kwargs)
           end
 
           def chained_command? command
@@ -128,7 +123,7 @@ module Contrast
           # @return [Boolean] if the agent should report all command
           #   executions.
           def report_any_command_execution?
-            PROTECT.report_any_command_execution?
+            ::Contrast::PROTECT.report_any_command_execution?
           end
         end
       end

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # The base class used to determine if a user input crosses a token boundary or

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base'
@@ -17,10 +17,7 @@ module Contrast
           BLOCK_MESSAGE = 'Untrusted Deserialization rule triggered. Deserialization blocked.'
 
           # Gadgets that map to ERB modules
-          ERB_GADGETS = %W[
-            object:ERB
-            o:\bERB
-          ].cs__freeze
+          ERB_GADGETS = %W[object:ERB o:\bERB].cs__freeze
 
           # Gadgets that map to ActionDispatch modules
           ACTION_DISPATCH_GADGETS = %w[
@@ -29,11 +26,7 @@ module Contrast
           ].cs__freeze
 
           # Gadgets that map to Arel Modules
-          AREL_GADGETS = %w[
-            string:Arel::Nodes::SqlLiteral
-            object:Arel::Nodes
-            o:\bArel::Nodes
-          ].cs__freeze
+          AREL_GADGETS = %w[string:Arel::Nodes::SqlLiteral object:Arel::Nodes o:\bArel::Nodes].cs__freeze
 
           # Used to indicate to TeamServer the gadget is an ERB module
           ERB = 'ERB'
@@ -45,7 +38,7 @@ module Contrast
 
           # Return the TeamServer understood id / name of this rule.
           # @return [String] the TeamServer understood id / name of this rule.
-          def name
+          def rule_name
             NAME
           end
 
@@ -124,8 +117,8 @@ module Contrast
             sample = build_base_sample(context, input_analysis_result)
             sample.untrusted_deserialization = Contrast::Api::Dtm::UntrustedDeserializationDetails.new
 
-            deserializer = kwargs[:GADGET_TYPE]
-            sample.untrusted_deserialization.deserializer = Contrast::Utils::StringUtils.protobuf_safe_string(deserializer)
+            deserializer = Contrast::Utils::StringUtils.protobuf_safe_string(kwargs[:GADGET_TYPE])
+            sample.untrusted_deserialization.deserializer = deserializer
 
             command = !!kwargs[:COMMAND_SCOPE]
             sample.untrusted_deserialization.command = command
@@ -148,7 +141,7 @@ module Contrast
           #   of the analysis done by this rule.
           def build_evaluation gadget_string
             ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.rule_id = name
+            ia_result.rule_id = rule_name
             ia_result.input_type = :UNKNOWN
             ia_result.key = INPUT_NAME
             ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(gadget_string)

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
@@ -12,7 +12,7 @@ module Contrast
           NAME = 'method-tampering'
           STANDARD_METHODS = %w[GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH].cs__freeze
 
-          def name
+          def rule_name
             NAME
           end
 
@@ -30,20 +30,9 @@ module Contrast
 
             method = ia_results.first.value
             result = if response_code.to_s.start_with?('4', '5')
-                       build_attack_without_match(
-                           context,
-                           nil,
-                           nil,
-                           method: method,
-                           response_code: response_code)
+                       build_attack_without_match(context, nil, nil, method: method, response_code: response_code)
                      else
-                       build_attack_with_match(
-                           context,
-                           nil,
-                           nil,
-                           nil,
-                           method: method,
-                           response_code: response_code)
+                       build_attack_with_match(context, nil, nil, nil, method: method, response_code: response_code)
                      end
             append_to_activity(context, result) if result
           end

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
@@ -12,7 +12,7 @@ module Contrast
           NAME = 'nosql-injection'
           BLOCK_MESSAGE = 'NoSQLi rule triggered. Response blocked.'
 
-          def name
+          def rule_name
             NAME
           end
 
@@ -32,7 +32,11 @@ module Contrast
           end
 
           def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
-            return result if mode == :NO_ACTION || mode == :PERMIT
+            if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION ||
+                  mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+
+              return result
+            end
 
             attack_string = input_analysis_result.value
             regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -14,9 +14,7 @@ module Contrast
             # Is the current & next character '//' or are the current and
             # subsequent characters '<--' ?
             def start_line_comment? char, index, query
-              if char == Contrast::Utils::ObjectShare::SLASH &&
-                    query[index + 1] == Contrast::Utils::ObjectShare::SLASH
-
+              if char == Contrast::Utils::ObjectShare::SLASH && query[index + 1] == Contrast::Utils::ObjectShare::SLASH
                 return true
               end
 

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -1,8 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
-require 'contrast/components/interface'
 require 'contrast/utils/stack_trace_utils'
 
 module Contrast
@@ -12,9 +11,6 @@ module Contrast
         # This class handles our implementation of the Path Traversal
         # Protect rule.
         class PathTraversal < Contrast::Agent::Protect::Rule::BaseService
-          include Contrast::Components::Interface
-          access_component :agent, :analysis
-
           NAME = 'path-traversal'
           SYSTEM_PATHS = %w[
             /proc/self
@@ -29,7 +25,7 @@ module Contrast
             /windows/repair/
           ].cs__freeze
 
-          def name
+          def rule_name
             NAME
           end
 
@@ -42,9 +38,8 @@ module Contrast
             append_to_activity(context, result)
             return unless blocked?
 
-            raise Contrast::SecurityException.new(
-                self,
-                "Path Traversal rule triggered. Call to File.#{ method } blocked.")
+            raise Contrast::SecurityException.new(self,
+                                                  "Path Traversal rule triggered. Call to File.#{ method } blocked.")
           end
 
           protected
@@ -97,7 +92,7 @@ module Contrast
           end
 
           def custom_code_access_sysfile_enabled?
-            PROTECT.report_custom_code_sysfile_access?
+            ::Contrast::PROTECT.report_custom_code_sysfile_access?
           end
 
           def custom_code_accessing_system_file? input
@@ -128,7 +123,8 @@ module Contrast
             #     return 'NUL' in str(e) or 'null byte' in str(e) or (PY34 and 'embedded NUL character' == str(e))
             #   except Exception as e:
             #     return 'null byte' in str(e).lower()
-            #   return return any([bypass_markers.lower().rstrip('/') in realpath for bypass_markers in PathTraversalREPMixin.KNOWN_SECURITY_BYPASS_MARKERS])
+            #   return return any([bypass_markers.lower().rstrip('/') in realpath for bypass_markers in
+            #   PathTraversalREPMixin.KNOWN_SECURITY_BYPASS_MARKERS])
             false
           end
         end

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
@@ -13,7 +13,7 @@ module Contrast
           NAME = 'sql-injection'
           BLOCK_MESSAGE = 'SQLi rule triggered. Response blocked.'
 
-          def name
+          def rule_name
             NAME
           end
 
@@ -52,7 +52,7 @@ module Contrast
 
               result ||= build_attack_result(context)
               record_match(idx, length, boundary, last_boundary, kwargs)
-              append_match(context, input_analysis_result, result, query_string, kwargs)
+              append_match(context, input_analysis_result, result, query_string, **kwargs)
             end
 
             result

data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # This class is the concrete implementation of the DefaultSqlScanner designed

data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
@@ -12,7 +12,7 @@ module Contrast
           NAME = 'unsafe-file-upload'
           BLOCK_MESSAGE = 'Unsafe file upload rule triggered. Request blocked.'
 
-          def name
+          def rule_name
             NAME
           end
         end

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 require 'contrast/agent/protect/rule/base_service'
@@ -12,7 +12,7 @@ module Contrast
           NAME = 'reflected-xss'
           BLOCK_MESSAGE = 'XSS rule triggered. Response blocked.'
 
-          def name
+          def rule_name
             NAME
           end