contrast-agent 5.3.0 → 6.0.0

data/lib/contrast/utils/class_util.rb

@@ -50,8 +50,8 @@ module Contrast
         # After implementing the LRU Cache, we firstly need to check if already had that object cached and if we have
         # it - we can return it directly; otherwise we'll calculate and store the result before returning.
         #
-        # TODO: RUBY-1327
-        # Once we move to 2.7+, we can combine the caches using ID b/c the memory location stops being the id
+        # Combining of the caches have close performance, but keeping the two with current implementation has
+        # a slight advantage in performance. For now we can keep the things the way they are.
         #
         # @param object [Object, nil] the entity to convert to a String
         # @return [String, Object] the human readable form of the String, as defined by
@@ -98,16 +98,7 @@ module Contrast
         def truly_defined? name
           return false unless name
 
-          segments = name.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
-          previous_module = Module
-          segments.each do |segment|
-            return false if previous_module.cs__autoload?(segment)
-            return false unless previous_module.cs__const_defined?(segment)
-
-            previous_module = previous_module.cs__const_get(segment)
-          end
-
-          true
+          Module.cs__const_defined?(name)
         rescue NameError # account for nonsense / poorly formatted constants
           false
         end

data/lib/contrast/utils/input_classification.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This module will include all the similar information for all input classifications
+        # between different rules
+        module InputClassificationBase
+          include Contrast::Agent::Reporting::InputType
+          include Contrast::Agent::Reporting::ScoreLevel
+
+          # Input Classification stage is done to determine if an user input is
+          # WORTHWATCHING or to be ignored.
+          #
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          # @param input_analysis [Contrast::Agent::Reporting::InputAnalysis] Holds all the results from the
+          #                                                       agent analysis from the current
+          #                                                       Request.
+          # @return ia [Contrast::Agent::Reporting::InputAnalysis] with updated results.
+          def classify input_type, value, input_analysis # rubocop:disable Lint/UnusedMethodArgument
+            return false unless input_analysis.request
+
+            true
+          end
+
+          # Creates new isntance of InputAnalysisResult with basic info.
+          #
+          # @param rule_id [String] The name of the Protect Rule.
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          # @param path [String] the path of the current request context.
+          #
+          # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
+          def new_ia_result rule_id, input_type, path, value = nil
+            res = Contrast::Agent::Reporting::InputAnalysisResult.new
+            res.rule_id = rule_id
+            res.input_type = input_type
+            res.path = path
+            res.value = value
+            res
+          end
+
+          # This methods checks if input is value that matches a key in the input.
+          #
+          # @param request [Contrast::Agent::Request] the current request context.
+          # @param result [Contrast::Agent::Reporting::InputAnalysisResult] result to be updated.
+          # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
+          # @param value [String, Array<String>] the value of the input.
+          #
+          # @return result [Contrast::Agent::Reporting::InputAnalysisResult] updated with key result.
+          def add_needed_key request, result, input_type, value
+            case input_type
+            when COOKIE_VALUE
+              result.key = request.cookies.key(value)
+            when PARAMETER_VALUE
+              result.key = request.parameters.key(value)
+            else
+              result.key
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/log_utils.rb

@@ -160,7 +160,7 @@ module Contrast
           message << msg[0]
           message << severity
           message << extract_metadata(msg[1], msg[2])
-          message.join('|') + "\n"
+          "#{ message.join('|') }\n"
         end
       end
 

data/lib/contrast/utils/middleware_utils.rb

@@ -8,6 +8,13 @@ module Contrast
     module MiddlewareUtils
       private
 
+      # TODO: RUBY-1609 update this part of the method for Ruby Version and Year
+      LANGUAGE_DEPRECATION_VERSION = '2.7'
+      LANGUAGE_DEPRECATION_YEAR = '2023'
+      LANGUAGE_DEPRECATION_WARNING =
+        "[Contrast Security] [DEPRECATION] Support for Ruby #{ LANGUAGE_DEPRECATION_VERSION } will be removed in "\
+        "April #{ LANGUAGE_DEPRECATION_YEAR }. Please contact Customer Support prior if you require continued support."
+
       def setup_agent
         ::Contrast::SETTINGS.reset_state
 
@@ -51,14 +58,8 @@ module Contrast
       # deprecated and soon to be removed functionality. This method handles doing that by leveraging the standard
       # Kernel#warn approach
       def inform_deprecations
-        # Ruby 2.6 will be dropped in april of 2022. We'll begin the deprecation warnings
-        # now so that customers have time to reach out if they'll be impacted.
-        # TODO: RUBY-1188 remove this part of the method, leaving it empty if there are no other deprecations, when we
-        #   drop 2.6 support.
-        return unless RUBY_VERSION < '2.7.0'
-
-        Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.6 will be removed in April 2022. '\
-                    'Please contact Customer Support prior if you require continued support.')
+        # Warn customers that they're on a version that's losing support in the next year.
+        Kernel.warn(LANGUAGE_DEPRECATION_WARNING) if RUBY_VERSION.start_with?(LANGUAGE_DEPRECATION_VERSION)
       end
 
       # Displays Telemetry disclaimer if Telemetry is enabled.

data/lib/contrast/utils/net_http_base.rb

@@ -22,7 +22,7 @@ module Contrast
       # @param use_custom_cert [Boolean] flag used to indicate whether the client is to use
       # self signed certificates provided by config [default = false]
       # @return [Net::HTTP, nil] Return open connection or nil
-      def initialize_connection service_name, url, use_proxy = false, use_custom_cert = false
+      def initialize_connection service_name, url, use_proxy: false, use_custom_cert: false
         return unless url
 
         addr = URI(url)

data/lib/contrast/utils/object_share.rb

@@ -10,6 +10,7 @@ module Contrast
     module ObjectShare
       # Strings
       ASTERISK =      '*'
+      AMPERSAND =     '&'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
       COLON =         ':'
@@ -38,6 +39,7 @@ module Contrast
       COLON_SLASH_SLASH = '://'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
+      BANG =           '!'
 
       WRITE_FLAG =    'w'
 
@@ -47,7 +49,6 @@ module Contrast
       CACHE = 'cache'
 
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
-      DOUBLE_COLON = '::'
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze

data/lib/contrast/utils/os.rb

@@ -53,11 +53,6 @@ module Contrast
         def linux?
           (unix? and !mac?)
         end
-
-        def jruby?
-          @_jruby = RUBY_ENGINE == 'jruby' if @_jruby.nil?
-          @_jruby
-        end
       end
     end
   end

data/lib/contrast/utils/patching/policy/patch_utils.rb

@@ -35,10 +35,9 @@ module Contrast
         # Given a method, return a symbol in the format
         # <method_start>_unbound_<method_name>
         def build_unbound_method_name patcher_method
-          (Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START +
-            'unbound' +
-            Contrast::Utils::ObjectShare::UNDERSCORE +
-            patcher_method.to_s).to_sym
+          "#{ Contrast::Utils::ObjectShare::CONTRAST_PATCHED_METHOD_START }unbound"\
+          "#{ Contrast::Utils::ObjectShare::UNDERSCORE }"\
+          "#{ patcher_method }".to_sym
         end
 
         # ===== PATCH APPLIERS =====
@@ -138,7 +137,7 @@ module Contrast
           if method_policy.source_node
             # If we were given a frozen return, and it was the target of a source, and we have frozen sources enabled,
             # we'll need to replace the return. Note, this is not the default case.
-            source_ret = Contrast::Agent::Assess::Policy::SourceMethod.source_patchers(method_policy, object, ret, args)
+            source_ret = Contrast::Agent::Assess::Policy::SourceMethod.apply_source(method_policy, object, ret, args)
           end
           if method_policy.propagation_node
             propagated_ret = Contrast::Agent::Assess::Policy::PropagationMethod.apply_propagation(

data/lib/contrast/utils/response_utils.rb

@@ -36,39 +36,24 @@ module Contrast
         return unless body
         return if defined?(Rack::File) && body.is_a?(Rack::File)
 
-        case body
-        when Rack::BodyProxy
-          handle_rack_body_proxy(body)
-        when ActionDispatch::Response::RackBody
-          extract_body(body.body) if defined?(ActionDispatch::Response::RackBody)
-        when Rack::Response
-          extract_body(body.body)
-        when Contrast::Utils::DuckUtils.quacks_to?(body, :each)
-          acc = []
-          body.each { |tmp| acc << read_or_string(tmp) }
-          acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
-        when ActionView::OutputBuffer
-          # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
-          body.to_str
-        else
-          read_or_string(body)
-        end
-        # if body.is_a?(Rack::BodyProxy)
-        #   handle_rack_body_proxy(body)
-        # elsif (defined?(ActionDispatch::Response::RackBody) && body.is_a?(ActionDispatch::Response::RackBody)) ||
-        #       body.is_a?(Rack::Response)
-        #
-        #   extract_body(body.body)
-        # elsif Contrast::Utils::DuckUtils.quacks_to?(body, :each)
-        #   acc = []
-        #   body.each { |tmp| acc << read_or_string(tmp) }
-        #   acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
-        # elsif ActionView::OutputBuffer
-        #   # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
-        #   body.to_str
-        # else
-        #   read_or_string(body)
-        # end
+        return handle_rack_body_proxy(body) if body.is_a?(Rack::BodyProxy)
+        return extract_body(body.body) if sub_extractable?(body)
+        return enumerable_text_from(body) if Contrast::Utils::DuckUtils.quacks_to?(body, :each)
+        # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
+        return body.to_str if body.is_a?(ActionView::OutputBuffer)
+
+        read_or_string(body)
+      end
+
+      def sub_extractable? body
+        (defined?(ActionDispatch::Response::RackBody) && body.is_a?(ActionDispatch::Response::RackBody)) ||
+            body.is_a?(Rack::Response)
+      end
+
+      def enumerable_text_from body
+        entries = body.map { |entry| read_or_string(entry) }
+        entries.compact!
+        entries.join(Contrast::Utils::ObjectShare::NEW_LINE)
       end
 
       def handle_rack_body_proxy body

data/lib/contrast/utils/telemetry.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/agent/telemetry'
+require 'contrast/agent/telemetry/telemetry'
 require 'contrast/utils/telemetry_identifier'
 
 module Contrast

data/lib/contrast/utils/telemetry_client.rb

@@ -22,7 +22,7 @@ module Contrast
       # @param url [String]
       # @return [Net::HTTP, nil] Return open connection or nil
       def initialize_connection url
-        super(SERVICE_NAME, url, false, false)
+        super(SERVICE_NAME, url, use_proxy: false, use_custom_cert: false)
       end
 
       # This method will be responsible for building the request. Because the telemetry collector expects to receive

data/lib/contrast/utils/telemetry_identifier.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/agent/telemetry'
+require 'contrast/agent/telemetry/telemetry'
 require 'contrast/utils/os'
 require 'socket'
 

data/resources/assess/policy.json

@@ -790,6 +790,16 @@
       "patch_method": "select_tagger",
       "source": "O",
       "target": "R"
+    },{
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "slice",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Select",
+      "patch_method": "select_tagger",
+      "source": "O",
+      "target": "R"
     },{
       "class_name":"CGI::Util",
       "method_name":"unescape",
@@ -1112,6 +1122,67 @@
       "target":"O",
       "action":"SPLAT"
     },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "get_string",
+      "source": "O",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Buffer",
+      "patch_method": "propagate_keep_select"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "slice",
+      "source": "O",
+      "target": "R",
+      "action": "CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::Buffer",
+      "patch_method": "propagate_keep_select"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "set_string",
+      "source":"P0,O",
+      "target":"O",
+      "action": "BUFFER",
+      "patch_method": "propagate_insert"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": false,
+      "method_visibility": "public",
+      "method_name": "for",
+      "source":"P0",
+      "target":"R",
+      "action": "KEEP"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "copy",
+      "source":"P0,O",
+      "target":"O",
+      "action": "BUFFER",
+      "patch_method": "buffer_keep_splat"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "pread",
+      "source":"P0,O",
+      "target":"O",
+      "action": "BUFFER",
+      "patch_method": "buffer_keep_splat"
+    },
     {
        "class_name": "ERB",
        "method_name": "result",
@@ -1177,6 +1248,33 @@
       "action": "REMOVE",
       "tags":["HTML_ENCODED"],
       "untags":["HTML_DECODED"]
+    },
+    {
+      "class_name": "IO::Buffer",
+      "instance_method": false,
+      "method_visibility": "public",
+      "method_name": "map",
+      "source": "P0,O",
+      "target": "R",
+      "action": "KEEP"
+    },
+     {
+      "class_name": "IO::Buffer",
+      "method_name": "pwrite",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source": "O",
+      "target": "P0",
+      "action": "KEEP"
+    },
+    {
+      "class_name": "IO::Buffer",
+      "method_name": "write",
+      "instance_method": true,
+      "method_visibility": "public",
+      "source": "O",
+      "target": "P0",
+      "action": "KEEP"
     }
   ],
   "rules":[

data/resources/deadzone/policy.json

@@ -200,92 +200,6 @@
       "method_visibility": "public",
       "method_name":"exists?",
       "code": "https://github.com/rails/rails/blob/v6.0.3.4/actionpack/lib/action_dispatch/request/session.rb#L201"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BaseMatcher"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeAKindOf"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeAnInstanceOf"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeBetween"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Be"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeComparedTo"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeFalsey"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeHelpers"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeNil"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BePredicate"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeTruthy"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::BeWithin"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Change"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::ChangeRelatively"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::SpecificValuesChange"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Compound"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Compound::And"
-    }, {
-      "class_name": "RSpec::Matchers::BuiltIn::Compound::Or"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::ContainExactly"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Cover"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::EndWith"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Eq"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Eql"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Equal"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Exist"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Has"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::HaveAttributes"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::All"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Match"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::NegativeOperatorMatcher"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::OperatorMatcher"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Output"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::PositiveOperatorMatcher"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::RaiseError"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::RespondTo"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::Satisfy"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::StartWith"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::ThrowSymbol"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::YieldControl"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::YieldSuccessiveArgs"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::YieldWithArgs"
-    },{
-      "class_name": "RSpec::Matchers::BuiltIn::YieldWithNoArgs"
-    },{
-      "class_name": "SimpleCov"
     }
   ]
 }

data/ruby-agent.gemspec

@@ -50,7 +50,7 @@ end
 def self.add_frameworks spec
   spec.add_development_dependency 'grape', '~> 1.5', '>= 1.5.2'
   spec.add_development_dependency 'rack-protection', '>= 2'
-  spec.add_development_dependency 'rails', '6.0.3.5'
+  spec.add_development_dependency 'rails', '~> 7'
   spec.add_development_dependency 'sinatra', '>= 2'
 end
 
@@ -70,6 +70,7 @@ def self.add_specs spec
   add_tested_gems(spec)
 
   spec.add_development_dependency 'benchmark-ips'
+  spec.add_development_dependency 'benchmark-memory', '~> 0.1'
   spec.add_development_dependency 'climate_control' # mock ENV
   spec.add_development_dependency 'factory_bot'
   spec.add_development_dependency 'fake_ftp'
@@ -89,11 +90,11 @@ end
 
 # Dependencies used to run all of our Rubocop during the linting phase.
 def self.add_rubocop spec
-  spec.add_development_dependency 'rubocop', '1.22.3'
-  spec.add_development_dependency 'rubocop-performance', '1.12.0'
-  spec.add_development_dependency 'rubocop-rails', '2.12.4'
+  spec.add_development_dependency 'rubocop', '1.26.1'
+  spec.add_development_dependency 'rubocop-performance', '1.13.3'
+  spec.add_development_dependency 'rubocop-rails', '2.14.2'
   spec.add_development_dependency 'rubocop-rake', '0.6.0'
-  spec.add_development_dependency 'rubocop-rspec', '2.6.0'
+  spec.add_development_dependency 'rubocop-rspec', '2.9.0'
 end
 
 # Dependencies not mocked out during RSpec that we test real code of, beyond just frameworks.
@@ -169,11 +170,11 @@ Gem::Specification.new do |spec|
 
   spec.summary      = 'Contrast Security\'s agent for rack-based applications.'
   spec.description  = 'This gem instantiates a Rack middleware for rack-based ' \
-    'web applications in order to provide Interactive Application Security ' \
-    'Testing and Protection.'
+                      'web applications in order to provide Interactive Application Security ' \
+                      'Testing and Protection.'
   spec.homepage     = 'https://www.contrastsecurity.com'
   spec.license      = 'CONTRAST SECURITY (see license file)'
-  spec.required_ruby_version = ['>= 2.6.0', '< 3.2.0']
+  spec.required_ruby_version = ['>= 2.7.0', '< 3.2.0']
 
   spec.bindir        = 'exe'
   spec.executables   = ['contrast_service']

data/service_executables/VERSION

@@ -1 +1 @@
-2.28.14
+2.28.19