contrast-agent 5.0.0 → 5.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4976ba07d49361d91d44561f93031bfbe6b0aaff32921c62c8a6841e1e9581ad
-  data.tar.gz: 510081d49ac928d43cd2f97ab310b6f6dcd122c1227e52d35c40f6ff5f423723
+  metadata.gz: c756fb0e7fe0433c7507c2cdb7082e635adabea8847c545333d65800225b1e3d
+  data.tar.gz: c71e1a8d020e3dfe98ea58d844924b0b0a9e1576b5f6899d186abc28e4efb152
 SHA512:
-  metadata.gz: e1dff81a71f5162d2f217ef061ae060b77d825a85fc0666e667b845e62f5e209b8d409bb2fe554af774f904d3586461a35c264fedb5c63c4f1d9a1130c7ed0c0
-  data.tar.gz: '013393f427c6539d164f7f647d2b8635ef4c7093e8dbd517631c03ae2ad3a5b7e8529bce82e80cea5f5c3ad630c537abd7114f98042f01b4977059ebb5ad1aaf'
+  metadata.gz: 82a0a252fa7696b2590f8be43fba09e03c6b13371a58a678b31e088e01a244311e0ac9d5b077de5d7970c16bc9a2144504d01a0e037c5e0f0b06d06e8530c57a
+  data.tar.gz: d9fd4708ab8238a22a2e3187e880a898635739b00f0d2f4f224904325f3b88b28f3470cf37733d5875e97018a02a5bfe10bd7f041219fd842b596e9697bfdbb6

data/.simplecov

@@ -1,9 +1,8 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-SimpleCov.minimum_coverage line: 94.75
+SimpleCov.minimum_coverage line: 95
 SimpleCov.start do
   add_filter '/spec/'
-  add_filter '/lib/contrast/extension/assess/erb.rb'
   enable_coverage :branch
 end

data/ext/cs__assess_module/cs__assess_module.c

@@ -61,39 +61,39 @@ VALUE
 contrast_assess_module_prepend(const int argc, const VALUE *argv,
                                const VALUE self) {
 
-    rb_prepend_module(self, argv[0]);
+    //    rb_prepend_module(self, argv[0]);
 
     VALUE module_at;
     VALUE rb_incl_in_mod_ary = rb_funcall(self, rb_intern("included_in"), 0);
 
     if (RB_TYPE_P(rb_incl_in_mod_ary, T_ARRAY)) {
-       int i = 0;
-       int size = rb_funcall(rb_incl_in_mod_ary, rb_intern("length"), 0);
-       for (i = 0; i < size; ++i) {
-           module_at = rb_ary_entry(rb_incl_in_mod_ary, i);
-           if (RB_TYPE_P(module_at, T_MODULE)) {
-              rb_include_module(module_at, argv[0]);
-           }
-       }
+        int i = 0;
+        int size = rb_funcall(rb_incl_in_mod_ary, rb_intern("length"), 0);
+        for (i = 0; i < size; ++i) {
+            module_at = rb_ary_entry(rb_incl_in_mod_ary, i);
+            if (RB_TYPE_P(module_at, T_MODULE)) {
+                rb_include_module(module_at, argv[0]);
+            }
+        }
     }
     return self;
 }
 
 VALUE
 contrast_assess_module_included(const int argc, const VALUE *argv,
-                               const VALUE self) {
-   VALUE frozen;
-   if (RB_TYPE_P(self, T_MODULE)) {
-       // check if frozen
-       frozen = rb_funcall(self, rb_intern("cs__frozen?"), 0);
-       if (frozen == Qfalse) {
-           VALUE ary = rb_funcall(self, rb_intern("included_in"), 0);
-           if (RB_TYPE_P(ary, T_ARRAY)) {
-              rb_ary_push(ary, argv[0]);
-           }
-       }
-   }
-   return self;
+                                const VALUE self) {
+    VALUE frozen;
+    if (RB_TYPE_P(self, T_MODULE)) {
+        // check if frozen
+        frozen = rb_funcall(self, rb_intern("cs__frozen?"), 0);
+        if (frozen == Qfalse) {
+            VALUE ary = rb_funcall(self, rb_intern("included_in"), 0);
+            if (RB_TYPE_P(ary, T_ARRAY)) {
+                rb_ary_push(ary, argv[0]);
+            }
+        }
+    }
+    return self;
 }
 
 void Init_cs__assess_module(void) {
@@ -115,13 +115,23 @@ void Init_cs__assess_module(void) {
 
     contrast_register_patch("Module", "module_eval",
                             contrast_assess_module_module_eval);
-   /*
-    * We patch these for better ancestors handling, and only for older ruby versions.
-    */
-  if (rb_ver_below_three()) {
-     contrast_register_patch("Module", "included",
-                             contrast_assess_module_included);
-     contrast_register_patch("Module", "prepend",
-                             contrast_assess_module_prepend);
-     }
+    /*
+     * We patch these for better ancestors handling, and only for older ruby
+     * versions.
+     */
+    //  if (rb_ver_below_three()) {
+    /*
+     * `included` is a private method. We should make it public, patch it,
+     * and make our new method public
+     */
+    //     contrast_register_patch("Module", "included",
+    //                             contrast_assess_module_included);
+    /*
+     * The `prepend` patch may actually be the issue, if we're not properly
+     * passing along the call/context. It could be that my attempt to fix
+     * `included` left this section unreachable.
+     */
+    //     contrast_register_patch("Module", "prepend",
+    //                             contrast_assess_module_prepend);
+    //     }
 }

data/lib/contrast/agent/assess/policy/propagator/match_data.rb

@@ -11,6 +11,10 @@ module Contrast
           # are unaffected beyond any merging of overlapping tags.
           class MatchData < Contrast::Agent::Assess::Policy::Propagator::Base
             class << self
+              # This patch method is used to track through the MatchData#[] and
+              # MatchData#match methods, since the last was introduced after
+              # Ruby 3.1.0, but shares similar functionality, except it does not
+              # support ranges.
               def square_bracket_tagger propagation_node, preshift, ret, _block
                 case ret
                 when Array

data/lib/contrast/agent/assess/rule/response/autocomplete_rule.rb

@@ -18,10 +18,6 @@ module Contrast
 
             protected
 
-            HTML_PROP = 'html'.cs__freeze
-            START_PROP = 'start'.cs__freeze
-            END_PROP = 'end'.cs__freeze
-
             # Rules discern which responses they can/should analyze.
             #
             # @param response [Contrast::Agent::Response] the response of the application
@@ -44,42 +40,6 @@ module Contrast
               nil
             end
 
-            # Find the forms in this body, if any, so as to determine if they violate this rule.
-            #
-            # @param body [String]
-            # @return [Array<Hash>] the forms of this body, as well as their start and end indexes.
-            def forms body
-              forms = []
-              body_start = 0
-              # The instance of "<form" in the body may be a form. Turn them into chunks to check.
-              potential_forms = body.split(form_start)
-              potential_forms.each do |potential_form|
-                # We can consider this a form if the next character is one of whitespace of form tag closing
-                # characters.
-                next unless potential_form
-                next unless form_openings.any? { |opening| potential_form.start_with?(opening) }
-
-                body_start = body.index(form_start, body_start)
-                next unless body_start
-
-                form_stop = potential_form.index('>').to_i
-                next unless form_stop
-
-                body_close = body_start + 6 + form_stop
-                forms << capture(body, body_start, body_close, form_stop)
-                body_start = body_close
-              end
-              forms
-            end
-
-            def form_start
-              /<form/i
-            end
-
-            def form_openings
-              [' ', "\n", "\r", "\t", '>']
-            end
-
             def off_values
               [/"off"/, /'off'/, /off /, /off>/]
             end
@@ -100,28 +60,6 @@ module Contrast
               end
               true
             end
-
-            # Capture the information needed to build the properties of this finding by parsing out from the body
-            #
-            # @param body [String] the entire HTTP Response body
-            # @param body_start [Integer] the start of the range to take from the body
-            # @param body_close [Integer] the end of the range to take from the body
-            # @param form_stop [Integer] the index of the end of the form from its start
-            # @return [Hash]
-            def capture body, body_start, body_close, form_stop
-              form = {}
-              # Capture the 50 characters in front of the form, or up to the start if the form starts before 50.
-              capture_start = body_start < 50 ? 0 : body_start - 50
-              # Start is where the '<form' is in the body
-              # 6 accounts for the characters in the form and the opening char
-              # potential_form.index('>') accounts for finding the rest of the form
-              # 50 accounts for the context to capture beyond
-              capture_close = body_close + 50
-              form[HTML_PROP] = body[capture_start...capture_close]
-              form[START_PROP] = body_start < 50 ? body_start : 50
-              form[END_PROP] = form[START_PROP] + 6 + form_stop
-              form
-            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/response/base_rule.rb

@@ -40,6 +40,11 @@ module Contrast
 
             protected
 
+            DATA = 'data'.cs__freeze
+            HTML_PROP = 'html'.cs__freeze
+            START_PROP = 'start'.cs__freeze
+            END_PROP = 'end'.cs__freeze
+
             # Rules discern which responses they can/should analyze.
             #
             # @param response [Contrast::Agent::Response] the response of the application
@@ -68,15 +73,24 @@ module Contrast
               finding.rule_id = rule_id
               context = Contrast::Agent::REQUEST_TRACKER.current
               finding.routes << context.route if context&.route
-              evidence.each_pair do |key, value|
-                finding.properties[key] = Contrast::Utils::StringUtils.force_utf8(value)
-              end
+              build_evidence evidence, finding
               hash = Contrast::Utils::HashDigest.generate_config_hash(finding)
               finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash)
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
               finding
             end
 
+            # This method allows to change the evidence we attach and the way we attach it
+            # Change it accordingly the rule you work on
+            #
+            # @param evidence [Hash] the properties required to build this finding.
+            # @param finding [Contrast::Api::Dtm::Finding] finding to attach the evidence to
+            def build_evidence evidence, finding
+              evidence.each_pair do |key, value|
+                finding.properties[key] = Contrast::Utils::StringUtils.force_utf8(value)
+              end
+            end
+
             # A rule is disabled if assess is off or it is turned off by TeamServer or by configuration.
             #
             # @return [Boolean]
@@ -109,6 +123,72 @@ module Contrast
             def body? response
               Contrast::Utils::StringUtils.present?(response.body)
             end
+
+            # Capture the information needed to build the properties of this finding by parsing out from the body
+            #
+            # @param body [String] the entire HTTP Response body
+            # @param body_start [Integer] the start of the range to take from the body
+            # @param body_close [Integer] the end of the range to take from the body
+            # @param tag_stop [Integer] the index of the end of the html tag from its start
+            # @return [Hash]
+            def capture body, body_start, body_close, tag_stop
+              tag = {}
+              # Capture the 50 characters in front of the form, or up to the start if the form starts before 50.
+              capture_start = body_start < 50 ? 0 : body_start - 50
+              # Start is where the '<form' is in the body
+              # 6 accounts for the characters in the form and the opening char
+              # potential_form.index('>') accounts for finding the rest of the form
+              # 50 accounts for the context to capture beyond
+              capture_close = body_close + 50
+              tag[HTML_PROP] = body[capture_start...capture_close]
+              tag[START_PROP] = body_start < 50 ? body_start : 50
+              tag[END_PROP] = tag[START_PROP] + 6 + tag_stop
+              tag
+            end
+
+            # Find the forms in this body, if any, so as to determine if they violate this rule.
+            #
+            # @param body [String]
+            # @return [Array<Hash>] the forms of this body, as well as their start and end indexes.
+            def forms body
+              forms = []
+              body_start = 0
+              # The instance of "<form" in the body may be a form. Turn them into chunks to check.
+              potential_forms = body.split(form_start)
+              potential_forms.each do |potential_form|
+                # We can consider this a form if the next character is one of whitespace of form tag closing
+                # characters.
+                next unless potential_form
+                next unless form_openings.any? { |opening| potential_form.start_with?(opening) }
+
+                body_start = body.index(form_start, body_start)
+                next unless body_start
+
+                form_stop = potential_form.index('>').to_i
+                next unless form_stop
+
+                body_close = body_start + 6 + form_stop
+                forms << capture(body, body_start, body_close, form_stop)
+                body_start = body_close
+              end
+              forms
+            end
+
+            def form_start
+              /<form/i
+            end
+
+            def form_openings
+              [' ', "\n", "\r", "\t", '>']
+            end
+
+            # Determine if a response has headers.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Boolean]
+            def headers? response
+              response.headers.cs__is_a?(Hash)
+            end
           end
         end
       end

data/lib/contrast/agent/assess/rule/response/cachecontrol_rule.rb

@@ -0,0 +1,184 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+require 'json'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the body or the headers include and/or
+          # set incorrectly the cache-control header
+          class Cachecontrol < BaseRule
+            def rule_id
+              'cache-controls-missing'
+            end
+
+            protected
+
+            HEADER_KEY = 'Cache-Control'.cs__freeze
+            ACCEPTED_VALUES = %w[no-store no-cache].cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && body?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              # This rule is violated if the header is not there
+              # or if it's there, but the value is not 'no-store' or 'no-cache'
+              headers = response.headers
+              header_key_sym = HEADER_KEY.to_sym
+              cache_control = headers[HEADER_KEY] || headers[header_key_sym]
+              if cache_control && !valid_header?(cache_control)
+                return to_cachecontrol_rule('header', 'cache-control', cache_control)
+              end
+
+              body = response.body
+              # check if the meta tag is include it
+              tags = meta_tags(body)
+
+              tags.each do |tag|
+                return to_cachecontrol_rule('meta', 'pragma', tag[HTML_PROP]) if meta_cache_tag? tag[HTML_PROP]
+              end
+              # we should return if header not presented and no tags are detected
+              return {} if !(headers.key?(HEADER_KEY) || headers.key?(header_key_sym)) && tags.empty?
+
+              nil
+            end
+
+            def valid_header? header
+              ACCEPTED_VALUES.any? { |val| header.include?(val) || header == val }
+            end
+
+            # Find the tags in this body, if any, so as to determine if they violate this rule.
+            #
+            # @param body [String,nil]
+            # @return [Array<Hash>] the tags of this body, as well as their start and end indexes.
+            def meta_tags body
+              tags = []
+              body_start = 0
+
+              # meta tags are stored in the <head></head> section
+              head_section = body&.split(head_tag)
+              return [] unless head_section
+
+              potential_tags = head_section.map { |el| el.split(meta_start) }
+              potential_tags.flatten.each do |potential_tag|
+                next unless potential_tag
+                next unless tag_openings.any? { |opening| potential_tag.starts_with?(opening) }
+
+                body_start = body.index(meta_start, body_start)
+                next unless body_start
+
+                tag_stop = potential_tag.index('>').to_i
+                next unless tag_stop
+
+                body_close = body_start + 6 + tag_stop
+                tags << capture(body, body_start, body_close, tag_stop)
+                body_start = body_close
+              end
+              tags
+            end
+
+            def meta_start
+              /<meta/i
+            end
+
+            def head_tag
+              /<head>/i
+            end
+
+            def tag_openings
+              [' ', "\n", "\r", "\t"]
+            end
+
+            def accepted_http_values
+              [/'cache-control'/i, /"cache-control"/i]
+            end
+
+            def accepted_values
+              [/'no-cache'/i, /"no-cache"/i, /"no-store"/i, /'no-store'/i]
+            end
+
+            # Determine if the given metatag does not have a valid cache-control tag.
+            # Meta tags has the option to set http-equiv and content to set the http response header
+            # to define for the document
+            #
+            # @param tag [String] the meta tag
+            # @return [Boolean, nil]
+            def meta_cache_tag? tag
+              # Here we should determine the index of the needed keys
+              # http-equiv and content
+              http_equiv_idx = tag =~ /http-equiv=/i
+              return false unless http_equiv_idx
+
+              content_idx = tag =~ /content=/i
+              return false unless content_idx
+
+              # determine the value of the http-equiv if it's cache-control
+              http_equiv_idx += 11
+              is_valid = accepted_http_values.any? { |el| (tag =~ el) == http_equiv_idx }
+              return false unless is_valid
+
+              content_idx += 8
+              return false if accepted_values.any? { |value| (tag =~ value) == content_idx }
+
+              true
+            end
+
+            # This method allows to change the evidence we attach and the way we attach it
+            # Change it accordingly the rule you work on
+            #
+            # @param evidence [Hash] the properties required to build this finding.
+            # @param finding [Contrast::Api::Dtm::Finding] finding to attach the evidence to
+            def build_evidence evidence, finding
+              evidence.each_pair do |key, value|
+                finding.properties[key] = Contrast::Utils::StringUtils.protobuf_format(value)
+              end
+            end
+
+            # This method accepts the violation and transforms it to the proper hash
+            # before return in as violation
+            #
+            # @param type [String] String of Header or META of the type
+            # @param name [String] String of either cache-control or pragma
+            # @param value [String] String of the violated value
+            def to_cachecontrol_rule type, name, value
+              { data: { type: type, name: name, value: value }.to_s }
+            end
+
+            # Capture the information needed to build the properties of this finding by parsing out from the body
+            #
+            # @param body [String] the entire HTTP Response body
+            # @param body_start [Integer] the start of the range to take from the body
+            # @param body_close [Integer] the end of the range to take from the body
+            # @param tag_stop [Integer] the index of the end of the html tag from its start
+            # @return [Hash]
+            def capture body, body_start, body_close, tag_stop
+              # In this situation we don't need to capture before and after the meta tag, as this may produce an error
+              # So if we capture 30-50 chars before and after the tag, we may capture part of the tag, we want to
+              # inspect and eventually this wil return wrong string. Because of that - we split the <head> and take
+              # each meta tag and examine it
+              tag = {}
+              # we dont need to capture here before or after the meta tag
+              tag[HTML_PROP] = body[body_start...body_close]
+              tag[START_PROP] = body_start
+              tag[END_PROP] = tag[START_PROP] + 6 + tag_stop
+              tag
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/clickjacking_rule.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the headers contains the required header
+          class Clickjacking < BaseRule
+            def rule_id
+              'clickjacking-control-missing'
+            end
+
+            protected
+
+            HEADER_KEY = 'X-Frame-Options'.cs__freeze
+            HEADER_KEY_SYM = HEADER_KEY.to_sym
+            ACCEPTED_VALUES = [/^deny/i, /^sameorigin/i].cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && headers?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              headers = response.headers
+              cache_control = headers[HEADER_KEY] || headers[HEADER_KEY_SYM]
+              return unsafe_response unless cache_control
+              return unsafe_response(cache_control) unless valid_header?(cache_control)
+
+              nil
+            end
+
+            def valid_header? header
+              ACCEPTED_VALUES.any? { |val| header =~ val }
+            end
+
+            def unsafe_response value = ''
+              { data: value }
+            end
+
+            # Change it accordingly the rule you work on
+            #
+            # @param evidence [Hash] the properties required to build this finding.
+            # @param finding [Contrast::Api::Dtm::Finding] finding to attach the evidence to
+            def build_evidence evidence, finding
+              evidence.each_pair do |key, value|
+                finding.properties[key] = Contrast::Utils::StringUtils.protobuf_format(value)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/csp_header_insecure_rule.rb

@@ -0,0 +1,101 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check that the HTTP Headers include CSP header types
+          class CspHeaderInsecure < BaseRule
+            def rule_id
+              'csp-header-insecure'
+            end
+
+            protected
+
+            CSP_HEADERS = %w[CONTENT_SECURITY_POLICY X_CONTENT_SECURITY_POLICY X_WEBKIT_CSP].cs__freeze
+            SETTINGS = %w[
+              base-uri child-src default-src connect-src frame-src media-src object-src script-src
+              style-src form-action frame-ancestors plugin-types reflected-xss referer
+            ].cs__freeze
+            UNSAFE_VALUE_REGEXP = /^unsafe-(?:inline|eval)$/.cs__freeze
+            ASTERISK_REGEXP = /[*]/.cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && headers?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Contrast::Utils::ObjectShare::EMPTY_STRING, nil] if CSP Header is not found
+            def violated? response
+              settings = {}
+              csp_hash = get_csp_header_values(response.headers)
+              return if csp_hash.nil?
+
+              SETTINGS.each do |setting_attr|
+                value = csp_hash[setting_attr]
+                key = convert_key(setting_attr)
+                settings["#{ key }Secure"] = !value.nil? && value_secure?(value) && value_safe?(value)
+                settings["#{ key }Value"] = value.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : value
+              end
+              { DATA => settings }
+            end
+
+            # Get the CSP values from and transforms them to key value hash
+            #
+            # ex default-src 'self' *.test.com; img-src * becomes:
+            # { default-src: "'self' *.test.com", img-src: "*" }
+            #
+            # @param headers [Hash] the response of the application
+            # @return [Array, nil] array of CSP header values
+            def get_csp_header_values headers
+              csp_hash = {}
+              CSP_HEADERS.each do |header_key|
+                next unless headers[header_key]&.length&.positive?
+
+                values = headers[header_key].split(Contrast::Utils::ObjectShare::SEMICOLON)
+                values.each do |value|
+                  normalized = value.downcase.strip
+                  kv = normalized.split(Contrast::Utils::ObjectShare::SPACE, 2)
+                  csp_hash[kv[0]] = kv[1]
+                end
+              end
+              csp_hash
+            end
+
+            def value_secure? value
+              ASTERISK_REGEXP.match(value).nil?
+            end
+
+            def value_safe? value
+              UNSAFE_VALUE_REGEXP.match(value).nil?
+            end
+
+            # Converts the CSP key to camelcase to be used as key for evidence object
+            #
+            #  base-uri -> baseUri
+            #
+            # @param key [String] key as found in header
+            # @return [String] camelcase key
+            def convert_key key
+              return key unless key.include?('-')
+
+              str = key.split('-')
+              "#{ str[0] }#{ str[1].capitalize }"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/csp_header_missing_rule.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check that the HTTP Headers include CSP header types
+          class CspHeaderMissing < BaseRule
+            def rule_id
+              'csp-header-missing'
+            end
+
+            protected
+
+            CSP_HEADERS = %w[CONTENT_SECURITY_POLICY X_CONTENT_SECURITY_POLICY X_WEBKIT_CSP].cs__freeze
+
+            DATA = 'data'.cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && headers?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Contrast::Utils::ObjectShare::EMPTY_STRING, nil] if CSP Header is not found
+            def violated? response
+              response_headers = response.headers
+              return if CSP_HEADERS.any? { |header_key| response_headers[header_key]&.length&.positive? }
+
+              { DATA => Contrast::Utils::ObjectShare::EMPTY_STRING }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/hsts_header_rule.rb

@@ -0,0 +1,60 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # This rule checks if the HTTP Headers include HSTS header and ensures that the max-age value
+          # is set to a value greater than 0.
+          class HSTSHeader < BaseRule
+            def rule_id
+              'hsts-header-missing'
+            end
+
+            protected
+
+            HEADER_KEY = 'Strict-Transport-Security'
+            HEADER_KEY_SYM = HEADER_KEY.to_sym
+            MAX_AGE = 'max-age'
+            MAX_AGE_SYM = MAX_AGE.to_sym
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && response.headers.cs__is_a?(Hash)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash<data: Contrast::Utils::ObjectShare::EMPTY_STRING, String>, nil] return string
+            # representation of the max_age
+            def violated? response
+              headers = response.headers
+              target = headers[HEADER_KEY] || headers[HEADER_KEY_SYM]
+              # this rule is safe by default if no target => no evidence
+              # if the property max_age is not positive or absent then the rule is violated
+              return unless target
+
+              max_age = target[MAX_AGE] || target[MAX_AGE_SYM]
+              return if max_age.to_i.positive?
+
+              evidence max_age
+            end
+
+            # returns evidence that the max_age is negative or absent
+            #
+            # @param max_age [String] String representation of the max-age value to which the header is set
+            # @return [Hash<data: Contrast::Utils::ObjectShare::EMPTY_STRING, String>] return string representation of
+            # the max_age
+            def evidence max_age
+              { data: max_age.to_s }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/parameters_pollution_rule.rb

@@ -0,0 +1,60 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the body contains a form which
+          # incorrectly sets the action attribute.
+          class ParametersPollution < BaseRule
+            def rule_id
+              'parameter-pollution'
+            end
+
+            protected
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && body?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              body = response.body
+              forms = forms(body)
+              forms.each do |form|
+                # Because TeamServer will reject any subsequent form on the same page due to deduplication, we can
+                # skip out on the first violation.
+                return form if action?(form[HTML_PROP])
+              end
+              nil
+            end
+
+            def accepted_values
+              [/action="[^"]/i, /action='[^']/i, /action=[^\\'"]/i, /action=[^\s<>'"]/i].cs__freeze
+            end
+
+            def action? form
+              return true unless /action=/i.match?(form)
+
+              accepted_values.each do |off_value|
+                return false if form.match?(off_value)
+              end
+              true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/x_content_type_rule.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the response contains the needed header
+          class XContentType < BaseRule
+            def rule_id
+              'xcontenttype-header-missing'
+            end
+
+            protected
+
+            HEADER_KEY = 'X-Content-Type-Options'.cs__freeze
+            HEADER_KEY_SYM = HEADER_KEY.to_sym
+            ACCEPTED_VALUE = /^nosniff/i.cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && headers?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              headers = response.headers
+              x_content_type = headers[HEADER_KEY] || headers[HEADER_KEY_SYM]
+              return unsafe_response unless x_content_type
+              return unsafe_response x_content_type unless ACCEPTED_VALUE.match?(x_content_type)
+
+              nil
+            end
+
+            def unsafe_response value = ''
+              { data: value }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/response/x_xss_protection_rule.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/assess/rule/response/base_rule'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Response
+          # These rules check the content of the HTTP Response to determine if the response contains the needed header
+          class XXssProtection < BaseRule
+            def rule_id
+              'xxssprotection-header-disabled'
+            end
+
+            protected
+
+            HEADER_KEY = 'X-XSS-Protection'.cs__freeze
+            HEADER_KEY_SYM = HEADER_KEY.to_sym
+            ACCEPTED_VALUE = /^1/.cs__freeze
+
+            # Rules discern which responses they can/should analyze.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            def analyze_response? response
+              super && headers?(response)
+            end
+
+            # Determine if the Response violates the Rule or not. If it does, return the evidence that proves it so.
+            #
+            # @param response [Contrast::Agent::Response] the response of the application
+            # @return [Hash, nil] the evidence required to prove the violation of the rule
+            def violated? response
+              headers = response.headers
+              x_xss_protection = headers[HEADER_KEY] || headers[HEADER_KEY_SYM]
+              # header is safe by default so only need to return finding on failed value match
+              return unless x_xss_protection
+              return unsafe_response x_xss_protection unless ACCEPTED_VALUE.match?(x_xss_protection)
+
+              nil
+            end
+
+            def unsafe_response value = ''
+              { data: value }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/finding.rb

@@ -28,7 +28,17 @@ module Contrast
         attr_reader :rule_id, :routes, :events, :properties, :request
         attr_accessor :hash_code
 
-        PROPERTIES_RULES = ['autocomplete-missing'].cs__freeze
+        PROPERTIES_RULES = %w[
+          autocomplete-missing
+          cache-controls-missing
+          clickjacking-control-missing
+          xcontenttype-header-missing
+          hsts-header-missing
+          xxssprotection-header-disabled
+          csp-header-missing
+          csp-header-insecure
+          parameter-pollution
+        ].cs__freeze
 
         class << self
           # @param finding_dtm [Contrast::Api::Dtm::Finding]

data/lib/contrast/agent/request_context_extend.rb

@@ -2,6 +2,11 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/rule/response/autocomplete_rule'
+require 'contrast/agent/assess/rule/response/hsts_header_rule'
+require 'contrast/agent/assess/rule/response/cachecontrol_rule'
+require 'contrast/agent/assess/rule/response/clickjacking_rule'
+require 'contrast/agent/assess/rule/response/x_content_type_rule'
+require 'contrast/agent/assess/rule/response/parameters_pollution_rule'
 
 module Contrast
   module Agent
@@ -113,6 +118,14 @@ module Contrast
         return unless Contrast::Agent::Reporter.enabled?
 
         Contrast::Agent::Assess::Rule::Response::Autocomplete.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::HSTSHeader.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::Cachecontrol.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XXssProtection.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderMissing.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::CspHeaderInsecure.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::Clickjacking.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::XContentType.new.analyze(@response)
+        Contrast::Agent::Assess::Rule::Response::ParametersPollution.new.analyze(@response)
       rescue StandardError => e
         logger.error('Unable to extract information after request', e)
       end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '5.0.0'
+    VERSION = '5.1.0'
   end
 end

data/lib/contrast/extension/assess/erb.rb

@@ -4,6 +4,13 @@
 # This module is used to track propagation through ERB template rendering
 module ERBPropagator
   class << self
+    # After ERB#result method is called we need to take the tags to the target and keep the
+    # propagation.
+    #
+    # @param patcher [Contrast::Agent::Assess::Policy::PolicyNode] the node that governs this event
+    # @param preshift [Contrast::Agent::Assess::Preshift] Saved state before the propagation
+    # @param ret [the Return of the invoked method]
+    # @param _block [&block, nil] block passed
     def result_tagger patcher, preshift, ret, _block
       return unless preshift.args.length >= 1
       return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
@@ -26,6 +33,16 @@ module ERBPropagator
 
     private
 
+    # Checks if binded variables set includes the object we track and proceed to update tags in the returned value
+    #
+    # @param binding_variable_set [Array<Symbol>] list of local variables used in the binding of params
+    # @param used_binding [Binding] the binding in of the current event, saved as preshift argument
+    # @param erb_pre_result [String] the source saved in the preshift
+    # @param properties [Contrast::Agent::Assess::Properties] properties of the target if none create new
+    # @param parent_events [Array<Contrast::Agent::Assess::ContrastEvent>] parents event extracted from the source
+    #                                                                      properties
+    # @param ret [String] the Return of the invoked method
+    # @return [Array<Symbol>]
     def binding_variable_set binding_variable_set, used_binding, erb_pre_result, properties, parent_events, ret
       binding_variable_set.each do |bound_var_symbol|
         bound_variable_value = used_binding.local_variable_get(bound_var_symbol)

data/resources/assess/policy.json

@@ -634,6 +634,16 @@
       "source":"O",
       "target":"R",
       "action":"REMOVE"
+    }, {
+      "class_name":"MatchData",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name":"match",
+      "source":"O",
+      "target":"R",
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "square_bracket_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,

data/ruby-agent.gemspec

@@ -59,7 +59,7 @@ def self.add_linters spec
   spec.add_development_dependency 'debride', '1.8.2'
   spec.add_development_dependency 'fasterer', '0.9.0'
   spec.add_development_dependency 'flay', '2.12.1'
-  spec.add_development_dependency 'steep', '0.44.1'
+  spec.add_development_dependency 'steep', '0.47.0'
   add_rubocop(spec)
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.1.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-01-06 00:00:00.000000000 Z
+date: 2022-01-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -147,14 +147,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.44.1
+        version: 0.47.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.44.1
+        version: 0.47.0
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
@@ -617,18 +617,18 @@ executables:
 - contrast_service
 extensions:
 - ext/cs__common/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
+- ext/cs__assess_hash/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
 - ext/cs__assess_fiber_track/extconf.rb
+- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__assess_string/extconf.rb
 - ext/cs__assess_regexp/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_kernel/extconf.rb
-- ext/cs__assess_hash/extconf.rb
-- ext/cs__assess_string_interpolation26/extconf.rb
 - ext/cs__os_information/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_string/extconf.rb
 - ext/cs__assess_module/extconf.rb
 extra_rdoc_files: []
 files:
@@ -881,6 +881,14 @@ files:
 - lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb
 - lib/contrast/agent/assess/rule/response/autocomplete_rule.rb
 - lib/contrast/agent/assess/rule/response/base_rule.rb
+- lib/contrast/agent/assess/rule/response/cachecontrol_rule.rb
+- lib/contrast/agent/assess/rule/response/clickjacking_rule.rb
+- lib/contrast/agent/assess/rule/response/csp_header_insecure_rule.rb
+- lib/contrast/agent/assess/rule/response/csp_header_missing_rule.rb
+- lib/contrast/agent/assess/rule/response/hsts_header_rule.rb
+- lib/contrast/agent/assess/rule/response/parameters_pollution_rule.rb
+- lib/contrast/agent/assess/rule/response/x_content_type_rule.rb
+- lib/contrast/agent/assess/rule/response/x_xss_protection_rule.rb
 - lib/contrast/agent/assess/tag.rb
 - lib/contrast/agent/assess/tracker.rb
 - lib/contrast/agent/at_exit_hook.rb