contrast-agent 4.7.0 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b3d1ce6b9794d3923d2054d9a20bd31989fd0c6b4df2883f81ad3e740c04de5
-  data.tar.gz: 894505c04e850858f83e2207c52cc944f738ce19183051d9530cfdaf09f72ab7
+  metadata.gz: e9b59d691aacb946697f5e70adca3118f87953a30209d9fb5aebb232df42ec3f
+  data.tar.gz: b4f831bbb3bf826aa0e28ee7f8040aca3f1efd9b50af63f0196124766afcdaa6
 SHA512:
-  metadata.gz: 4df81e8b3d03efcdc952e9fce5330b34c6af6a965701ec7bbe02cf3dbd5b8a3c98d8d0745da91d7b0a43be6b03ac763ffb6e9eafb9f2b857bd2a76d325d10ad2
-  data.tar.gz: 0015e74007146cf741e6b7f6274460a948a147df54109de959856f0ff883262260685f74eff8767e6ae845847eaf3d8a17dfbd54061d5b9f561952a8c6b90fef
+  metadata.gz: c37bdcf57f387aa4c8353db52eb5dff04c7c1781c31b5af7dd12e87f79c31b7fdb942031e97f5e0f5ea9d5d29407725ac2a63916080fe4041def3627426a4428
+  data.tar.gz: 2a05dab78c39243740d7357f43484c26f6ede46d05f7f28ad212fe8914fbd19887021d2fe6d217aa1e9312ea33b9a4880dcaa7a4bf4cb75a43a6ce9db56d95e2

data/lib/contrast/agent/assess/policy/propagator.rb

@@ -21,6 +21,7 @@ module Contrast
           require 'contrast/agent/assess/policy/propagator/match_data'
           require 'contrast/agent/assess/policy/propagator/next'
           require 'contrast/agent/assess/policy/propagator/prepend'
+          require 'contrast/agent/assess/policy/propagator/rack_protection'
           require 'contrast/agent/assess/policy/propagator/remove'
           require 'contrast/agent/assess/policy/propagator/replace'
           require 'contrast/agent/assess/policy/propagator/reverse'

data/lib/contrast/agent/assess/policy/propagator/rack_protection.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module Propagator
+          # Rack::Protection offers several protections against vulnerabilities. Of these, some apply to dataflow and
+          # need to be accounted for in order to properly tag data. Others apply to configurations and may be used to
+          # suppress configuration vulnerabilities in the future.
+          class RackProtection < Contrast::Agent::Assess::Policy::Propagator::Base
+            class << self
+              # Our custom instrumentation for the Rack::Protection::EscapedParams#escape_string method
+              # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+              #   propagation event.
+              # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+              #   the invocation of the patched method.
+              # @param ret [nil, String] the target to which to propagate.
+              # @return [nil, String] ret
+              def escaped_params propagation_node, preshift, ret, _block
+                Contrast::Agent::Assess::Policy::Propagator::Splat.propagate(propagation_node, preshift, ret)
+                apply_escaper_tags(preshift.object, ret)
+                ret
+              end
+
+              private
+
+              # Rack::Protection::EscapedParams can be configured such that it only applies certain escape. We need
+              # to account for the configuration of the individual escapes when applying tags.
+              #
+              # @param escaper [Rack::Protection::EscapedParams] the instance of Rack::Protection::EscapedParams
+              #   applying the escape_string
+              # @param ret [String] the result of the escape
+              def apply_escaper_tags escaper, ret
+                # I don't know how this could not be an instance of Rack::Protection::EscapedParams, but I don't want
+                # to chance it.
+                return unless escaper.cs__is_a?(Rack::Protection::EscapedParams)
+                return unless (properties = Contrast::Agent::Assess::Tracker.properties(ret))
+
+                tags = []
+                untags = []
+                if escaper.instance_variable_get(:@html)
+                  tags << 'HTML_ENCODED'
+                  untags << 'HTML_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@javascript)
+                  tags << 'JAVASCRIPT_ENCODED'
+                  untags << 'JAVASCRIPT_DECODED'
+                end
+
+                if escaper.instance_variable_get(:@url)
+                  tags << 'URL_ENCODED'
+                  untags << 'URL_DECODED'
+                end
+
+                length = Contrast::Utils::StringUtils.ret_length(ret)
+                tags.each do |tag|
+                  properties.add_tag(tag, 0...length)
+                end
+
+                untags.each do |tag|
+                  properties.delete_tags(tag)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '4.7.0'
+    VERSION = '4.8.0'
   end
 end

data/lib/contrast/framework/rails/patch/support.rb

@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/framework/rails/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/railtie.rb

@@ -0,0 +1,32 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/job_servers_running'
+
+module Contrast
+  module Framework
+    module Rails
+      # A Railtie to allow for the automatic hooking of the Agent into a Rails application.
+      class Railtie < ::Rails::Railtie
+        include Contrast::Components::Interface
+        access_component :agent, :app_context, :logging
+
+        initializer 'Contrast Ruby Agent Initializer' do |app|
+          Rails.logger.debug("In railtie ::#{ app.middleware.inspect }") if defined?(Rails) && defined?(Rails.logger)
+
+          if APP_CONTEXT.instrument_middleware_stack?
+            AGENT.insert_middleware(app)
+          else
+            Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.')
+            logger.debug('Disabling Contrast for process', p_id: Process.pid)
+          end
+        end
+
+        rake_tasks do
+          load 'contrast/tasks/service.rb'
+          load 'contrast/tasks/config.rb'
+        end
+      end
+    end
+  end
+end

data/resources/assess/policy.json

@@ -1026,6 +1026,61 @@
        "action": "CUSTOM",
        "patch_class": "ERBPropagator",
        "patch_method": "result_tagger"
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "ActionView::Helpers::SanitizeHelper",
+      "method_name": "strip_tags",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rack::Protection::EscapedParams",
+      "method_name": "escape_string",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::RackProtection",
+      "patch_method": "escaped_params"
+    },
+    {
+      "class_name": "Rails::Html::FullSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "Rails::Html::SafeListSanitizer",
+      "method_name": "sanitize",
+      "method_visibility": "public",
+      "instance_method": true,
+      "source": "P0",
+      "target": "R",
+      "action": "REMOVE",
+      "tags":["HTML_ENCODED"],
+      "untags":["HTML_DECODED"]
     }
   ],
   "rules":[

data/ruby-agent.gemspec

@@ -41,6 +41,7 @@ end
 
 # Dependencies used for framework testing.
 def self.add_frameworks spec
+  spec.add_development_dependency 'rack-protection', '>= 2'
   spec.add_development_dependency 'rails', '6.0.3.5'
   spec.add_development_dependency 'sinatra', '>= 2'
 end
@@ -90,7 +91,7 @@ def self.add_tested_gems spec
   spec.add_development_dependency 'async'
   spec.add_development_dependency 'execjs'
   spec.add_development_dependency 'sqlite3'
-  spec.add_development_dependency 'therubyracer'
+  spec.add_development_dependency 'rhino'
   spec.add_development_dependency 'tilt'
   spec.add_development_dependency 'xpath'
 end

data/service_executables/VERSION

@@ -1 +1 @@
-2.19.0
+2.20.2

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.8.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-05-10 00:00:00.000000000 Z
+date: 2021-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -225,6 +225,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 0.21.2
+- !ruby/object:Gem::Dependency
+  name: rack-protection
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +310,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: therubyracer
+  name: rhino
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -542,19 +556,19 @@ executables:
 extensions:
 - ext/cs__common/extconf.rb
 - ext/cs__assess_string/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
 - ext/cs__protect_kernel/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
-- ext/cs__assess_array/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
+- ext/cs__assess_module/extconf.rb
+- ext/cs__assess_active_record_named/extconf.rb
 - ext/cs__assess_fiber_track/extconf.rb
+- ext/cs__assess_array/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
+- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
 - ext/cs__assess_marshal_module/extconf.rb
 - ext/cs__assess_basic_object/extconf.rb
-- ext/cs__assess_module/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_hash/extconf.rb
-- ext/cs__assess_active_record_named/extconf.rb
-- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -775,6 +789,7 @@ files:
 - lib/contrast/agent/assess/policy/propagator/match_data.rb
 - lib/contrast/agent/assess/policy/propagator/next.rb
 - lib/contrast/agent/assess/policy/propagator/prepend.rb
+- lib/contrast/agent/assess/policy/propagator/rack_protection.rb
 - lib/contrast/agent/assess/policy/propagator/remove.rb
 - lib/contrast/agent/assess/policy/propagator/replace.rb
 - lib/contrast/agent/assess/policy/propagator/reverse.rb
@@ -859,7 +874,6 @@ files:
 - lib/contrast/agent/protect/rule/xss.rb
 - lib/contrast/agent/protect/rule/xxe.rb
 - lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb
-- lib/contrast/agent/railtie.rb
 - lib/contrast/agent/reaction_processor.rb
 - lib/contrast/agent/request.rb
 - lib/contrast/agent/request_context.rb
@@ -973,6 +987,7 @@ files:
 - lib/contrast/framework/rails/patch/assess_configuration.rb
 - lib/contrast/framework/rails/patch/rails_application_configuration.rb
 - lib/contrast/framework/rails/patch/support.rb
+- lib/contrast/framework/rails/railtie.rb
 - lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb
 - lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb
 - lib/contrast/framework/rails/rewrite/active_record_named.rb

data/lib/contrast/agent/railtie.rb

@@ -1,31 +0,0 @@
-# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/job_servers_running'
-
-module Contrast
-  module Agent
-    # A Railtie to allow for the automatic hooking of the Agent into a Rails
-    # application.
-    class Railtie < Rails::Railtie
-      include Contrast::Components::Interface
-      access_component :agent, :app_context, :logging
-
-      initializer 'Contrast Ruby Agent Initializer' do |app|
-        Rails.logger.debug("In railtie ::#{ app.middleware.inspect }") if defined?(Rails) && defined?(Rails.logger)
-
-        if APP_CONTEXT.instrument_middleware_stack?
-          AGENT.insert_middleware(app)
-        else
-          Rails.logger.debug('Detected a running job server, skipping Contrast middleware insertion.')
-          logger.debug('Disabling Contrast for process', p_id: Process.pid)
-        end
-      end
-
-      rake_tasks do
-        load 'contrast/tasks/service.rb'
-        load 'contrast/tasks/config.rb'
-      end
-    end
-  end
-end