contrast-agent 5.3.0 → 6.1.1

data/lib/contrast/agent/reporting/settings/sampling.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # Sampling controls for the Assess Features provided by TeamServer
+        class Sampling
+          # @return [Integer] The number of baseline requests to take before switching to sampling for the window.
+          attr_reader :baseline
+          # @return [Boolean] If the sampling feature should be used or not.
+          attr_reader :enabled
+          # @return [Integer] The number of requests to skip before observing during the sampling window after the
+          #   baseline.
+          attr_reader :request_frequency
+          # @return [Integer] The number of responses to skip before observing during the sampling window after the
+          #  baseline.
+          attr_reader :response_frequency
+          # @return [Integer] The length of time for which the sample period is valid, in ms.
+          attr_reader :window_ms
+
+          def initialize hsh
+            @baseline = hsh[:baseline]
+            @enabled = hsh[:enabled]
+            @request_frequency = hsh[:frequency]
+            @response_frequency = hsh[:responseFrequency]
+            @window_ms = hsh[:window]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/sensitive_data_masking.rb

@@ -0,0 +1,110 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/sensitive_data_masking_rule'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # Protect level settings for the sensitive_data_masking_policy.
+        # Configuration of the masking parameters will be delivered dynamically from TeamServer
+        # during an ApplicationSettings response from requests to TS endpoints that return that
+        # structure.
+        # https://contrast.atlassian.net/wiki/spaces/~699189087/pages/807960614/Sensitive+Data+Masking+Design
+        class SensitiveDataMasking
+          # Policy flag to enable the use of masking on request body
+          # Here is set to defaults to true.
+          #
+          # @return true | false
+          def mask_http_body?
+            @_mask_http_body
+          end
+
+          # Set the flag for request body masking
+          #
+          # @param bool [Boolean]
+          # @return true | false
+          def mask_http_body= bool
+            @_mask_http_body = bool.nil? ? true : !!bool
+          end
+
+          # Policy flag to enable the use of masking on attack vector.
+          # Here is set to defaults to false.
+          #
+          # @return true | false
+          def mask_attack_vector?
+            @_mask_attack_vector
+          end
+
+          # Set the flag for using masking on attack vector
+          #
+          # @param bool [Boolean]
+          # @return true | false
+          def mask_attack_vector= bool
+            @_mask_attack_vector = !!bool
+          end
+
+          # Rules to follow when using the masking
+          #
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, []]
+          def rules
+            @_rules ||= Contrast::Agent::Reporting::Settings::RulesArray.new
+          end
+
+          # Assign rules array
+          #
+          # @param rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>]
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, []]
+          def rules= rules
+            @_rules = rules if rules_array?(rules)
+          end
+
+          # Build rules from hash
+          #
+          # @param settings_rules [Hash] Response settings under Settings/sensitive_data_masking_policy/rules
+          # @return rules [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>, nil
+          def build_rules_form_settings settings_rules
+            return unless settings_rules || settings_rules.empty?
+
+            settings_rules.each do |rule|
+              instance = Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule.new
+              instance.rule_id = rule[:id]
+              instance.keywords = rule[:keywords]
+              rules << instance
+            end
+            rules
+          end
+
+          private
+
+          # Determine if parameter is array of Rules.
+          #
+          # @param array [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>] Array of keywords.
+          # @return true | false
+          def rules_array? array
+            return false unless array.is_a?(Array)
+
+            array.all?(Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule)
+          end
+        end
+
+        # Simple validation class for Rules Array.
+        class RulesArray < Array
+          # Do not push anything except Rules instances.
+          # :<< method is called on object directly so this
+          # will make sure the data pushed is as expected.
+          #
+          # @param item [Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule]
+          # @return itself [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>]
+          def << item
+            return itself unless item.instance_of?(Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule)
+
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/sensitive_data_masking_rule.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # Protect level settings for the sensitive_data_masking_policy Rule entry.
+        class SensitiveDataMaskingRule
+          # Id for this rule.
+          #
+          # @return rule_id [String] Name of parameter to mask.
+          def rule_id
+            @_rule_id ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the rule name.
+          #
+          # @param id [String] Name of parameter to mask.
+          # @return rule_id [String]
+          def rule_id= id
+            @_rule_id = id.to_s
+          end
+
+          # Array of keywords to mask values for the rule_id.
+          #
+          # @return keywords [Array<String>] set of keywords
+          def keywords
+            @_keywords ||= []
+          end
+
+          # Set keywords array.
+          #
+          # @param words_array [Array<String>]
+          # @return keywords [Array<String>] set of keywords
+          def keywords= words_array
+            @_keywords = words_array if string_array?(words_array)
+          end
+
+          private
+
+          # Determine if a array is array of strings.
+          #
+          # @param array [Array<String] Array of keywords.
+          # @return true | false
+          def string_array? array
+            return false unless array.is_a?(Array) && array.any?
+
+            array.all?(String)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/server_features.rb

@@ -27,7 +27,7 @@ module Contrast
           # @param log_level [String]
           # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
           def log_level= log_level
-            @_log_level = log_level if log_level.is_a? String
+            @_log_level = log_level if log_level.is_a?(String)
           end
 
           # Where to log the agent's log file, if set by the user. Overridden by agent.logger.path
@@ -43,7 +43,7 @@ module Contrast
           # @param log_file [String] path
           # @return log_file [String] path
           def log_file= log_file
-            @_log_file = log_file if log_file.is_a? String
+            @_log_file = log_file if log_file.is_a?(String)
           end
 
           # Controls for the reporting of telemetry events from the agent to TeamServer.

data/lib/contrast/agent/request.rb

@@ -34,12 +34,14 @@ module Contrast
       LAST_REST_TOKEN = %r{/\d+$}.cs__freeze
       INNER_NUMBER_MARKER = '/{n}/'
       LAST_NUMBER_MARKER = '/{n}'
+      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
+      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
 
       attr_reader :rack_request
       attr_accessor :route, :observed_route, :new_observed_route
 
       # Delegate calls to the following methods to the attribute @rack_request
-      def_delegators :@rack_request, :base_url, :content_type, :cookies, :env, :ip, :path, :port, :query_string,
+      def_delegators :@rack_request, :base_url, :cookies, :env, :ip, :media_type, :path, :port, :query_string,
                      :request_method, :scheme, :url, :user_agent
 
       # Initialize new Contrast Request
@@ -86,9 +88,9 @@ module Contrast
       #
       # @return type [Symbol<:XML, :JSON, :NORMAL>]
       def document_type
-        @_document_type ||= if /xml/i.match?(content_type) || body&.start_with?('<?xml')
+        @_document_type ||= if /xml/i.match?(media_type) || body&.start_with?('<?xml')
                               :XML
-                            elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
+                            elsif /json/i.match?(media_type) || body&.match?(/\s*[{\[]/)
                               :JSON
                             else
                               :NORMAL
@@ -181,8 +183,6 @@ module Contrast
         @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
       end
 
-      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
-      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
       # Utility method for checking if a request is for a static resource.
       # @return [Boolean] true, if the request is for a well-known static
       #  type as determined by the request suffix or the accept header.

data/lib/contrast/agent/request_context.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/api/dtm.pb'
 require 'contrast/utils/timer'
 require 'contrast/agent/request'
 require 'contrast/agent/response'
@@ -16,20 +17,6 @@ module Contrast
   module Agent
     # This class acts to encapsulate information about the currently executed request, making it available to the Agent
     # for the duration of the request in a standardized and normalized format which the Agent understands.
-    #
-    # @attr_reader timer [Contrast::Utils::Timer] when the context was created
-    # @attr_reader logging_hash [Hash] context used to log the request
-    # @attr_reader speedracer_input_analysis [Contrast::Api::Settings::InputAnalysis] the protect input analysis of
-    #   sources on this request
-    # @attr_reader request [Contrast::Agent::Request] our wrapper around the Rack::Request for this context
-    # @attr_reader response [Contrast::Agent::Response] our wrapper aroudn the Rack::Response or Array for this context,
-    #   only available after the application has finished its processing
-    # @attr_reader activity [Contrast::Api::Dtm::Activity] the application activity found in this request
-    # @attr_reader server_activity [Contrast::Api::Dtm::ServerActivity] the server activity found in this request
-    # @attr_reader route [Contrast::Api::Dtm::RouteCoverage] the route, used for findings, of this request
-    # @attr_reader observed_route [Contrast::Api::Dtm::ObservedRoute] the route, used for coverage, of this request
-    # @attr_reader new_observed_route [Contrast::Agent::Reporting::ObservedRoute] the route, used for coverage, of this
-    # request
     class RequestContext
       include Contrast::Components::Logger::InstanceMethods
       include Contrast::Components::Scope::InstanceMethods
@@ -37,12 +24,30 @@ module Contrast
       include Contrast::Agent::RequestContextExtend
 
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
-      INPUT_ANALYSIS = Contrast::Agent::Reporting::InputAnalysis.new
 
-      attr_reader :activity, :logging_hash, :observed_route, :new_observed_route, :request, :response, :route,
-                  :speedracer_input_analysis, :agent_input_analysis, :server_activity, :timer
-
-      def initialize rack_request, app_loaded = true
+      # @return [Contrast::Api::Dtm::Activity] the application activity found in this request
+      attr_reader :activity
+      # @return [Hash] context used to log the request
+      attr_reader :logging_hash
+      # @return [Contrast::Agent::Reporting::ObservedRoute] the route, used for coverage, of this request
+      attr_reader :new_observed_route
+      # @return [Contrast::Api::Dtm::ObservedRoute] the route, used for coverage, of this request
+      attr_reader :observed_route
+      # @return [Contrast::Agent::Request] our wrapper around the Rack::Request for this context
+      attr_reader :request
+      # @return [Contrast::Agent::Response] our wrapper around the Rack::Response or Array for this context,
+      #   only available after the application has finished its processing
+      attr_reader :response
+      # @return [Contrast::Api::Dtm::RouteCoverage] the route, used for findings, of this request
+      attr_reader :route
+      # @return [Contrast::Api::Dtm::ServerActivity] the server activity found in this request
+      attr_reader :server_activity
+      # @return [Contrast::Api::Settings::InputAnalysis] the protect input analysis of sources on this request
+      attr_reader :speedracer_input_analysis
+      # @return [Contrast::Utils::Timer] when the context was created
+      attr_reader :timer
+
+      def initialize rack_request, app_loaded: true
         with_contrast_scope do
           # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new
@@ -61,8 +66,7 @@ module Contrast
           @speedracer_input_analysis = EMPTY_INPUT_ANALYSIS_PB
           speedracer_input_analysis.request = request
 
-          @agent_input_analysis = INPUT_ANALYSIS
-          agent_input_analysis.request = request
+          # TODO: RUBY-1627
 
           # flag to indicate whether the app is fully loaded
           @app_loaded = !!app_loaded

data/lib/contrast/agent/request_context_extend.rb

@@ -76,15 +76,16 @@ module Contrast
         return false unless ::Contrast::PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
+        service_response = Contrast::Agent&.messaging_queue&.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)
         ia = service_response.input_analysis
         if ia
-          service_extract_logging ia
+          service_extract_logging(ia)
+          # TODO: RUBY-1629
           # using Agent analysis
-          initialize_agent_input_analysis request
+          # initialize_agent_input_analysis request
 
           @speedracer_input_analysis = ia
           speedracer_input_analysis.request = request
@@ -93,7 +94,7 @@ module Contrast
           false
         end
       rescue Contrast::SecurityException => e
-        raise e
+        raise(e)
       rescue StandardError => e
         logger.warn('Unable to extract Contrast Service information from request', e)
         false
@@ -115,7 +116,7 @@ module Contrast
         # If Contrast Service has NOT handled the input analysis, handle them here
         build_attack_results(agent_settings)
         logger.debug('Contrast Service said to block this request')
-        raise Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior'))
+        raise(Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior')))
       end
 
       # append anything we've learned to the request seen message this is the sum-total of all inventory information
@@ -126,6 +127,7 @@ module Contrast
         @response = Contrast::Agent::Response.new(rack_response)
         return unless @sample_res
 
+        #
         # TODO: RUBY-1376 once all rules translated, move this to if/else w/ the enabled
         if Contrast::Agent::Reporter.enabled?
           Contrast::Agent::Assess::Rule::Response::AutoComplete.new.analyze(@response)
@@ -146,7 +148,7 @@ module Contrast
 
       # This here is for things we don't have implemented
       def log_to_cef
-        activity.results.each { |attack_result| logging_logic attack_result, attack_result.rule_id.downcase }
+        activity.results.each { |attack_result| logging_logic(attack_result, attack_result.rule_id.downcase) }
       end
 
       # @param input_analysis [Contrast::Api::Settings::InputAnalysis]
@@ -171,7 +173,7 @@ module Contrast
           next unless rule
 
           logger.debug(BUILD_ATTACK_LOGGER_MESSAGE, result: ia_result.inspect) if logger.debug?
-          results_by_rule[rule_id] = attack_result rule, rule_id, ia_result, results_by_rule
+          results_by_rule[rule_id] = attack_result(rule, rule_id, ia_result, results_by_rule)
         end
 
         results_by_rule.each_pair do |_, attack_result|
@@ -198,21 +200,6 @@ module Contrast
                           end
       end
 
-      # Sets request to be used with agent and service input analysis.
-      #
-      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request
-      # for this context
-      def initialize_agent_input_analysis request
-        # using Agent analysis
-        ia = Contrast::Agent::Protect::InputAnalyzer.analyse request
-        if ia
-          @agent_input_analysis = ia
-        else
-          logger.trace('Analysis from Agent was empty.')
-
-        end
-      end
-
       def logging_logic result, rule_id
         rules = %w[bot_blocker virtual_patch ip_denylist]
         return unless rules.include?(rule_id)
@@ -221,14 +208,14 @@ module Contrast
         outcome = Contrast::Api::Dtm::AttackResult::ResponseType.get_name_by_tag(result.response)
         case rule_id
         when /bot_blocker/i
-          blocker_to_json = Contrast::Api::Dtm::BotBlockerDetails.to_controlled_hash rule_details
+          blocker_to_json = Contrast::Api::Dtm::BotBlockerDetails.to_controlled_hash(rule_details)
           cef_logger.bot_blocking_message(blocker_to_json, outcome)
         when /virtual_patch/i
-          virtual_patch_to_json = Contrast::Api::Dtm::VirtualPatchDetails.to_controlled_hash rule_details
+          virtual_patch_to_json = Contrast::Api::Dtm::VirtualPatchDetails.to_controlled_hash(rule_details)
           cef_logger.virtual_patch_message(virtual_patch_to_json, outcome)
         when /ip_denylist/i
           sender_ip = extract_sender_ip
-          ip_denylist_to_json = Contrast::Api::Dtm::IpDenylistDetails.to_controlled_hash rule_details
+          ip_denylist_to_json = Contrast::Api::Dtm::IpDenylistDetails.to_controlled_hash(rule_details)
           return unless sender_ip
           return unless sender_ip.include?(ip_denylist_to_json[:ip])
 

data/lib/contrast/agent/request_handler.rb

@@ -5,6 +5,7 @@ require 'contrast/components/logger'
 require 'contrast/components/scope'
 require 'contrast/agent/reporting/reporter'
 require 'contrast/agent/reporting/reporting_utilities/dtm_message'
+require 'contrast/agent/reporting/masker/masker'
 
 module Contrast
   module Agent
@@ -46,18 +47,21 @@ module Contrast
       # This method is used to send our JSON messages directly to TeamServer at the end of each request. As we move
       # more endpoints over, this method will take the messages originally sent by #send_actiivty_messages. At the end,
       # that method should be removed.
-      # TODO: RUBY-1358
-      def report_activity
+      def report_activity # rubocop:disable Metrics/AbcSize
         return unless Contrast::Agent::Reporter.enabled?
 
         reporter = Contrast::Agent.reporter
         return unless reporter
 
+        # Mask Sensitive Data
+        Contrast::Agent::Reporting::Masker.mask(context.activity)
+
         Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage(context.activity)
         [
           context.new_observed_route,
           Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.server_activity),
-          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages)
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity.library_usages),
+          Contrast::Agent::Reporting::DtmMessage.dtm_to_event(context.activity)
         ].each do |event|
           reporter.send_event(event)
         rescue StandardError => e

data/lib/contrast/agent/response.rb

@@ -22,6 +22,8 @@ module Contrast
 
       extend Forwardable
 
+      # @return [Array, Rack::Response] The Rack Response passed by the application & middleware. It can be an Array
+      #   in format [response_code, header_hash, response_body] or an instance of Rack::Response
       attr_reader :rack_response
 
       def initialize rack_response

data/lib/contrast/agent/rule_set.rb

@@ -23,7 +23,7 @@ module Contrast
         end
       rescue Contrast::SecurityException => e
         logger.warn('RASP threw security exception in prefilter', e)
-        raise e
+        raise(e)
       rescue StandardError => e
         logger.error('Unexpected exception during prefilter', e)
       end
@@ -39,7 +39,7 @@ module Contrast
         end
       rescue Contrast::SecurityException => e
         logger.warn('RASP threw security exception in postfilter', e)
-        raise e
+        raise(e)
       rescue StandardError => e
         logger.error('Unexpected exception during postfilter', e)
       end

data/lib/contrast/agent/scope.rb

@@ -142,7 +142,7 @@ module Contrast
         # @param scope_sym [Symbol] scope to check.
         # @return [Boolean] true | false
         def valid_scope? scope_sym
-          Contrast::Agent::Scope::SCOPE_LIST.include? scope_sym
+          Contrast::Agent::Scope::SCOPE_LIST.include?(scope_sym)
         end
       end
     end

data/lib/contrast/agent/service_heartbeat.rb

@@ -7,71 +7,29 @@ require 'contrast/agent/reporting/report'
 
 module Contrast
   module Agent
-    # The ServiceHeartbeat functions to keep the Contrast Service alive and
-    # ensure that it maintains this Agent's ApplicationContext.
+    # The ServiceHeartbeat functions to keep the Contrast Service alive and ensure that it maintains this Agent's
+    # ApplicationContext.
     class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Logger::InstanceMethods
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      # check if we can report to TS
-      #
-      # @return[Boolean] true if bypass is enabled, or false if bypass disabled
-      def enabled?
-        @_enabled = Contrast::CONTRAST_SERVICE.use_agent_communication? if @_enabled.nil?
-        @_enabled
-      end
-
-      def client
-        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
-      end
-
-      def connection
-        @_connection ||= client.initialize_connection
-      end
-
       def start_thread!
+        return if ::Contrast::CONTRAST_SERVICE.unnecessary?
         return if running?
 
-        report_from_reporter = check_report_provider
-
         @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
-            if report_from_reporter
-              client.send_event(poll_message, connection)
-            else
-              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
-            end
-
-            sleep REFRESH_INTERVAL_SEC
+            Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+            sleep(REFRESH_INTERVAL_SEC)
           end
         end
       end
 
       def poll_message
-        @_poll_message ||= if enabled? && client
-                             Contrast::Agent::Reporting::Poll.new
-                           else
-                             Contrast::Api::Dtm::Poll.new
-                           end
-      end
-
-      def check_report_provider
-        return false unless enabled?
-        return false unless client && connection
-
-        client.startup!(connection)
-        true
-      end
-
-      def send_event provider
-        if provider
-          client.send_event(poll_message, connection)
-          return
-        end
-        Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
+        @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
     end
   end

data/lib/contrast/agent/static_analysis.rb

@@ -40,7 +40,7 @@ module Contrast
             inventory_report = Contrast::Agent::Reporting::ApplicationInventory.convert(app_update_msg)
             Contrast::Agent.reporter.send_event(inventory_report)
           else
-            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+            Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg, force: true)
           end
         end