contrast-agent 4.7.0 → 4.10.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +6 -1
- data/.rspec +0 -1
- data/.rspec_parallel +6 -0
- data/.simplecov +1 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.c +0 -1
- data/ext/cs__contrast_patch/cs__contrast_patch.h +0 -2
- data/lib/contrast/agent/assess/contrast_event.rb +1 -5
- data/lib/contrast/agent/assess/finalizers/hash.rb +2 -5
- data/lib/contrast/agent/assess/policy/patcher.rb +5 -4
- data/lib/contrast/agent/assess/policy/policy.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +2 -6
- data/lib/contrast/agent/assess/policy/preshift.rb +11 -8
- data/lib/contrast/agent/assess/policy/propagation_method.rb +102 -59
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +2 -7
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +31 -11
- data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb +73 -0
- data/lib/contrast/agent/assess/policy/propagator/split.rb +10 -6
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +3 -3
- data/lib/contrast/agent/assess/policy/propagator.rb +1 -0
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +6 -7
- data/lib/contrast/agent/assess/policy/source_method.rb +18 -22
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +0 -4
- data/lib/contrast/agent/assess/policy/trigger_method.rb +61 -86
- data/lib/contrast/agent/assess/policy/trigger_node.rb +1 -1
- data/lib/contrast/agent/assess/property/evented.rb +2 -1
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +3 -4
- data/lib/contrast/agent/at_exit_hook.rb +3 -3
- data/lib/contrast/agent/class_reopener.rb +6 -5
- data/lib/contrast/agent/disable_reaction.rb +4 -5
- data/lib/contrast/agent/exclusion_matcher.rb +2 -7
- data/lib/contrast/agent/inventory/database_config.rb +117 -0
- data/lib/contrast/agent/inventory/dependency_analysis.rb +2 -6
- data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +8 -9
- data/lib/contrast/agent/inventory/policy/datastores.rb +5 -6
- data/lib/contrast/agent/inventory/policy/policy.rb +1 -1
- data/lib/contrast/agent/middleware.rb +15 -13
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +6 -3
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +21 -16
- data/lib/contrast/agent/patching/policy/module_policy.rb +2 -4
- data/lib/contrast/agent/patching/policy/patch.rb +13 -8
- data/lib/contrast/agent/patching/policy/patch_status.rb +3 -7
- data/lib/contrast/agent/patching/policy/patcher.rb +14 -14
- data/lib/contrast/agent/patching/policy/policy.rb +2 -4
- data/lib/contrast/agent/patching/policy/policy_node.rb +2 -3
- data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb +1 -1
- data/lib/contrast/agent/protect/policy/policy.rb +1 -1
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +3 -5
- data/lib/contrast/agent/protect/rule/base.rb +10 -10
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +4 -5
- data/lib/contrast/agent/protect/rule/no_sqli.rb +7 -53
- data/lib/contrast/agent/protect/rule/path_traversal.rb +1 -5
- data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +137 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +7 -70
- data/lib/contrast/agent/reaction_processor.rb +3 -4
- data/lib/contrast/agent/request.rb +9 -5
- data/lib/contrast/agent/request_context.rb +28 -31
- data/lib/contrast/agent/request_handler.rb +5 -3
- data/lib/contrast/agent/response.rb +2 -3
- data/lib/contrast/agent/rewriter.rb +4 -3
- data/lib/contrast/agent/rule_set.rb +5 -4
- data/lib/contrast/agent/service_heartbeat.rb +2 -3
- data/lib/contrast/agent/static_analysis.rb +7 -6
- data/lib/contrast/agent/thread.rb +2 -4
- data/lib/contrast/agent/thread_watcher.rb +3 -4
- data/lib/contrast/agent/tracepoint_hook.rb +10 -5
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/api/communication/messaging_queue.rb +16 -11
- data/lib/contrast/api/communication/response_processor.rb +11 -11
- data/lib/contrast/api/communication/service_lifecycle.rb +9 -5
- data/lib/contrast/api/communication/socket_client.rb +18 -14
- data/lib/contrast/api/communication/speedracer.rb +5 -6
- data/lib/contrast/api/decorators/address.rb +2 -3
- data/lib/contrast/api/decorators/agent_startup.rb +7 -9
- data/lib/contrast/api/decorators/application_startup.rb +9 -10
- data/lib/contrast/api/decorators/application_update.rb +0 -4
- data/lib/contrast/api/decorators/http_request.rb +3 -7
- data/lib/contrast/api/decorators/instrumentation_mode.rb +3 -5
- data/lib/contrast/api/decorators/message.rb +7 -7
- data/lib/contrast/api/decorators/route_coverage.rb +24 -1
- data/lib/contrast/api/decorators/trace_event_object.rb +2 -3
- data/lib/contrast/components/agent.rb +13 -15
- data/lib/contrast/components/app_context.rb +7 -11
- data/lib/contrast/components/assess.rb +19 -16
- data/lib/contrast/components/base.rb +40 -0
- data/lib/contrast/components/config.rb +1 -2
- data/lib/contrast/components/contrast_service.rb +8 -11
- data/lib/contrast/components/heap_dump.rb +5 -4
- data/lib/contrast/components/inventory.rb +2 -7
- data/lib/contrast/components/logger.rb +14 -10
- data/lib/contrast/components/protect.rb +10 -13
- data/lib/contrast/components/sampling.rb +5 -5
- data/lib/contrast/components/scope.rb +9 -32
- data/lib/contrast/components/settings.rb +1 -5
- data/lib/contrast/config/base_configuration.rb +14 -6
- data/lib/contrast/configuration.rb +22 -19
- data/lib/contrast/extension/assess/array.rb +3 -15
- data/lib/contrast/extension/assess/eval_trigger.rb +2 -23
- data/lib/contrast/extension/assess/fiber.rb +6 -16
- data/lib/contrast/extension/assess/hash.rb +3 -13
- data/lib/contrast/extension/assess/kernel.rb +3 -14
- data/lib/contrast/extension/assess/marshal.rb +6 -14
- data/lib/contrast/extension/assess/regexp.rb +5 -15
- data/lib/contrast/extension/assess/string.rb +6 -31
- data/lib/contrast/extension/extension.rb +61 -0
- data/lib/contrast/extension/kernel.rb +2 -4
- data/lib/contrast/extension/protect/kernel.rb +0 -15
- data/lib/contrast/framework/grape/support.rb +174 -0
- data/lib/contrast/framework/manager.rb +44 -9
- data/lib/contrast/framework/rack/patch/session_cookie.rb +6 -6
- data/lib/contrast/framework/rack/support.rb +1 -1
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +5 -8
- data/lib/contrast/framework/rails/patch/support.rb +44 -37
- data/lib/contrast/framework/rails/railtie.rb +34 -0
- data/lib/contrast/framework/rails/rewrite/active_record_named.rb +4 -4
- data/lib/contrast/framework/rails/support.rb +60 -13
- data/lib/contrast/framework/sinatra/support.rb +1 -1
- data/lib/contrast/funchook/funchook.rb +4 -3
- data/lib/contrast/logger/application.rb +1 -6
- data/lib/contrast/logger/log.rb +103 -13
- data/lib/contrast/logger/request.rb +0 -4
- data/lib/contrast/tasks/config.rb +0 -1
- data/lib/contrast/tasks/service.rb +1 -6
- data/lib/contrast/utils/assess/sampling_util.rb +2 -3
- data/lib/contrast/utils/assess/tracking_util.rb +2 -4
- data/lib/contrast/utils/heap_dump_util.rb +5 -3
- data/lib/contrast/utils/invalid_configuration_util.rb +4 -3
- data/lib/contrast/utils/io_util.rb +3 -5
- data/lib/contrast/utils/job_servers_running.rb +4 -3
- data/lib/contrast/utils/os.rb +2 -3
- data/lib/contrast/utils/ruby_ast_rewriter.rb +16 -13
- data/lib/contrast/utils/string_utils.rb +2 -3
- data/lib/contrast/utils/tag_util.rb +26 -19
- data/lib/contrast.rb +24 -14
- data/resources/assess/policy.json +252 -2
- data/resources/deadzone/policy.json +10 -0
- data/ruby-agent.gemspec +14 -3
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +104 -24
- data/lib/contrast/agent/railtie.rb +0 -31
- data/lib/contrast/components/interface.rb +0 -196
- data/lib/contrast/delegators/input_analysis.rb +0 -12
- data/lib/contrast/utils/inventory_util.rb +0 -114
@@ -1,12 +0,0 @@
|
|
1
|
-
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
-
# frozen_string_literal: true
|
3
|
-
|
4
|
-
module Contrast
|
5
|
-
module Delegators
|
6
|
-
# Used to decorate the InputAnalysis protobuf model so it can own the
|
7
|
-
# Contrast::Agent::Request from which it came.
|
8
|
-
class InputAnalysis < SimpleDelegator
|
9
|
-
attr_accessor :request
|
10
|
-
end
|
11
|
-
end
|
12
|
-
end
|
@@ -1,114 +0,0 @@
|
|
1
|
-
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
-
# frozen_string_literal: true
|
3
|
-
|
4
|
-
require 'contrast/utils/timer'
|
5
|
-
require 'contrast/utils/object_share'
|
6
|
-
require 'contrast/components/interface'
|
7
|
-
|
8
|
-
module Contrast
|
9
|
-
module Utils
|
10
|
-
# Utilities for getting inventory information from the application
|
11
|
-
class InventoryUtil
|
12
|
-
include Contrast::Components::Interface
|
13
|
-
access_component :logging
|
14
|
-
|
15
|
-
# TeamServer only accepts certain values for ArchitectureComponents.
|
16
|
-
# DO NOT CHANGE THIS!
|
17
|
-
AC_TYPE_DB = 'db'
|
18
|
-
# TeamServer only accepts certain values for FlowMap Services.
|
19
|
-
# DO NOT CHANGE THIS
|
20
|
-
ADAPTER = 'adapter'
|
21
|
-
HOST = 'host'
|
22
|
-
PORT = 'port'
|
23
|
-
DATABASE = 'database'
|
24
|
-
DEFAULT = 'default'
|
25
|
-
LOCALHOST = 'localhost'
|
26
|
-
|
27
|
-
def self.active_record_config
|
28
|
-
return @_active_record_config if instance_variable_defined?(:@_active_record_config)
|
29
|
-
|
30
|
-
@_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
|
31
|
-
end
|
32
|
-
|
33
|
-
def self.append_db_config activity_or_update, hash_or_str = Contrast::Utils::InventoryUtil.active_record_config
|
34
|
-
arr = build_from_db_config(hash_or_str)
|
35
|
-
return unless arr&.any?
|
36
|
-
|
37
|
-
arr.each do |a|
|
38
|
-
next unless a
|
39
|
-
|
40
|
-
if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
|
41
|
-
activity_or_update.architectures << a
|
42
|
-
else
|
43
|
-
activity_or_update.components << a
|
44
|
-
end
|
45
|
-
end
|
46
|
-
rescue StandardError => e
|
47
|
-
logger.error('Unable to append db config', e)
|
48
|
-
nil
|
49
|
-
end
|
50
|
-
|
51
|
-
def self.build_from_db_config hash_or_str
|
52
|
-
return unless hash_or_str
|
53
|
-
|
54
|
-
if hash_or_str.is_a?(Hash)
|
55
|
-
build_from_db_hash(hash_or_str)
|
56
|
-
else
|
57
|
-
build_from_db_string(hash_or_str.to_s)
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
def self.build_from_db_hash hash
|
62
|
-
ac = Contrast::Api::Dtm::ArchitectureComponent.new
|
63
|
-
ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
|
64
|
-
ac.remote_host = host_from_hash(hash)
|
65
|
-
ac.remote_port = port_from_hash(hash)
|
66
|
-
ac.type = AC_TYPE_DB
|
67
|
-
ac.url = hash[:database] || hash[DATABASE] || DEFAULT
|
68
|
-
[ac]
|
69
|
-
end
|
70
|
-
|
71
|
-
def self.host_from_hash hash
|
72
|
-
hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
|
73
|
-
end
|
74
|
-
|
75
|
-
def self.port_from_hash hash
|
76
|
-
p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
|
77
|
-
p.to_i
|
78
|
-
end
|
79
|
-
|
80
|
-
# Examples:
|
81
|
-
# mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
|
82
|
-
# postgresql://scott:tiger@localhost/mydatabase
|
83
|
-
# mysql+mysqlconnector://scott:tiger@localhost/foo
|
84
|
-
def self.build_from_db_string str
|
85
|
-
adapter, hosts, database = split_connection_str(str)
|
86
|
-
acs = []
|
87
|
-
hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
|
88
|
-
host, port = s.split(Contrast::Utils::ObjectShare::COLON)
|
89
|
-
|
90
|
-
ac = Contrast::Api::Dtm::ArchitectureComponent.new
|
91
|
-
ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
|
92
|
-
ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
|
93
|
-
ac.remote_port = port.to_i
|
94
|
-
ac.type = AC_TYPE_DB
|
95
|
-
ac.url = Contrast::Utils::StringUtils.force_utf8(database)
|
96
|
-
acs << ac
|
97
|
-
end
|
98
|
-
acs
|
99
|
-
end
|
100
|
-
|
101
|
-
def self.split_connection_str str
|
102
|
-
adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
|
103
|
-
_auth, str = str.split(Contrast::Utils::ObjectShare::AT)
|
104
|
-
# Not currently used
|
105
|
-
# user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
|
106
|
-
hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
|
107
|
-
hosts << LOCALHOST if hosts.empty?
|
108
|
-
database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
|
109
|
-
|
110
|
-
[adapter, hosts, database]
|
111
|
-
end
|
112
|
-
end
|
113
|
-
end
|
114
|
-
end
|