contrast-agent 6.14.0 → 6.15.1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.14.0
+  version: 6.15.1
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-01-26 00:00:00.000000000 Z
+date: 2023-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -609,6 +609,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: ougai
   requirement: !ruby/object:Gem::Requirement
@@ -647,36 +661,16 @@ dependencies:
   name: contrast-agent-lib
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.1.0
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.3
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.1.0
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.3
-- !ruby/object:Gem::Dependency
-  name: ffi
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 1.1.0
 description: This gem instantiates a Rack middleware for rack-based web applications
   in order to provide Interactive Application Security Testing and Protection.
 email:
@@ -900,11 +894,12 @@ files:
 - lib/contrast-agent.rb
 - lib/contrast.rb
 - lib/contrast/agent.rb
-- lib/contrast/agent/assess.rb
+- lib/contrast/agent/assess/assess.rb
 - lib/contrast/agent/assess/contrast_object.rb
 - lib/contrast/agent/assess/events/event_data.rb
 - lib/contrast/agent/assess/finalizers/freeze.rb
 - lib/contrast/agent/assess/finalizers/hash.rb
+- lib/contrast/agent/assess/module_data.rb
 - lib/contrast/agent/assess/policy/dynamic_source_factory.rb
 - lib/contrast/agent/assess/policy/patcher.rb
 - lib/contrast/agent/assess/policy/policy.rb
@@ -971,22 +966,22 @@ files:
 - lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb
 - lib/contrast/agent/assess/tag.rb
 - lib/contrast/agent/assess/tracker.rb
-- lib/contrast/agent/at_exit_hook.rb
 - lib/contrast/agent/deadzone/policy/deadzone_node.rb
 - lib/contrast/agent/deadzone/policy/policy.rb
-- lib/contrast/agent/disable_reaction.rb
-- lib/contrast/agent/excluder.rb
-- lib/contrast/agent/exclusion_matcher.rb
-- lib/contrast/agent/inventory.rb
+- lib/contrast/agent/excluder/excluder.rb
+- lib/contrast/agent/excluder/exclusion_matcher.rb
+- lib/contrast/agent/hooks/at_exit_hook.rb
+- lib/contrast/agent/hooks/tracepoint_hook.rb
 - lib/contrast/agent/inventory/database_config.rb
 - lib/contrast/agent/inventory/dependencies.rb
 - lib/contrast/agent/inventory/dependency_analysis.rb
 - lib/contrast/agent/inventory/dependency_usage_analysis.rb
+- lib/contrast/agent/inventory/inventory.rb
 - lib/contrast/agent/inventory/policy/datastores.rb
 - lib/contrast/agent/inventory/policy/policy.rb
 - lib/contrast/agent/inventory/policy/trigger_node.rb
-- lib/contrast/agent/middleware.rb
-- lib/contrast/agent/module_data.rb
+- lib/contrast/agent/middleware/middleware.rb
+- lib/contrast/agent/middleware/static_analysis.rb
 - lib/contrast/agent/patching/policy/after_load_patch.rb
 - lib/contrast/agent/patching/policy/after_load_patcher.rb
 - lib/contrast/agent/patching/policy/method_policy.rb
@@ -1012,38 +1007,40 @@ files:
 - lib/contrast/agent/protect/policy/trigger_node.rb
 - lib/contrast/agent/protect/rule.rb
 - lib/contrast/agent/protect/rule/base.rb
-- lib/contrast/agent/protect/rule/base_service.rb
-- lib/contrast/agent/protect/rule/bot_blocker.rb
+- lib/contrast/agent/protect/rule/bot_blocker/bot_blocker.rb
 - lib/contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification.rb
-- lib/contrast/agent/protect/rule/cmd_injection.rb
+- lib/contrast/agent/protect/rule/cmdi/cmd_injection.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_backdoors.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb
 - lib/contrast/agent/protect/rule/default_scanner.rb
-- lib/contrast/agent/protect/rule/deserialization.rb
-- lib/contrast/agent/protect/rule/no_sqli.rb
+- lib/contrast/agent/protect/rule/deserialization/deserialization.rb
 - lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb
+- lib/contrast/agent/protect/rule/no_sqli/no_sqli.rb
 - lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb
-- lib/contrast/agent/protect/rule/path_traversal.rb
+- lib/contrast/agent/protect/rule/path_traversal/path_traversal.rb
 - lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb
 - lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb
-- lib/contrast/agent/protect/rule/sql_sample_builder.rb
-- lib/contrast/agent/protect/rule/sqli.rb
 - lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb
 - lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb
 - lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb
+- lib/contrast/agent/protect/rule/sqli/sql_sample_builder.rb
+- lib/contrast/agent/protect/rule/sqli/sqli.rb
 - lib/contrast/agent/protect/rule/sqli/sqli_base_rule.rb
 - lib/contrast/agent/protect/rule/sqli/sqli_input_classification.rb
 - lib/contrast/agent/protect/rule/sqli/sqli_semantic/sqli_dangerous_functions.rb
 - lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb
-- lib/contrast/agent/protect/rule/unsafe_file_upload.rb
+- lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload.rb
 - lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification.rb
-- lib/contrast/agent/protect/rule/xss.rb
+- lib/contrast/agent/protect/rule/utils/builders.rb
+- lib/contrast/agent/protect/rule/utils/filters.rb
 - lib/contrast/agent/protect/rule/xss/reflected_xss_input_classification.rb
-- lib/contrast/agent/protect/rule/xxe.rb
+- lib/contrast/agent/protect/rule/xss/xss.rb
 - lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb
+- lib/contrast/agent/protect/rule/xxe/xxe.rb
+- lib/contrast/agent/reactions/disable_reaction.rb
 - lib/contrast/agent/reporting/attack_result/attack_result.rb
 - lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb
 - lib/contrast/agent/reporting/attack_result/response_type.rb
@@ -1163,15 +1160,12 @@ files:
 - lib/contrast/agent/reporting/settings/validator.rb
 - lib/contrast/agent/reporting/settings/virtual_patch.rb
 - lib/contrast/agent/reporting/settings/virtual_patch_condition.rb
-- lib/contrast/agent/request.rb
-- lib/contrast/agent/request_context.rb
-- lib/contrast/agent/request_context_extend.rb
-- lib/contrast/agent/request_handler.rb
-- lib/contrast/agent/response.rb
-- lib/contrast/agent/rule_set.rb
-- lib/contrast/agent/scope.rb
-- lib/contrast/agent/static_analysis.rb
-- lib/contrast/agent/telemetry.rb
+- lib/contrast/agent/request/request.rb
+- lib/contrast/agent/request/request_context.rb
+- lib/contrast/agent/request/request_context_extend.rb
+- lib/contrast/agent/request/request_handler.rb
+- lib/contrast/agent/response/response.rb
+- lib/contrast/agent/scope/scope.rb
 - lib/contrast/agent/telemetry/base.rb
 - lib/contrast/agent/telemetry/client.rb
 - lib/contrast/agent/telemetry/event.rb
@@ -1185,11 +1179,11 @@ files:
 - lib/contrast/agent/telemetry/identifier.rb
 - lib/contrast/agent/telemetry/metric_event.rb
 - lib/contrast/agent/telemetry/startup_metrics_event.rb
-- lib/contrast/agent/thread.rb
-- lib/contrast/agent/thread_watcher.rb
-- lib/contrast/agent/tracepoint_hook.rb
+- lib/contrast/agent/telemetry/telemetry.rb
+- lib/contrast/agent/thread/thread.rb
+- lib/contrast/agent/thread/thread_watcher.rb
+- lib/contrast/agent/thread/worker_thread.rb
 - lib/contrast/agent/version.rb
-- lib/contrast/agent/worker_thread.rb
 - lib/contrast/agent_lib/api/command_injection.rb
 - lib/contrast/agent_lib/api/init.rb
 - lib/contrast/agent_lib/api/input_tracing.rb
@@ -1215,6 +1209,7 @@ files:
 - lib/contrast/components/polling.rb
 - lib/contrast/components/protect.rb
 - lib/contrast/components/ruby_component.rb
+- lib/contrast/components/rule_set.rb
 - lib/contrast/components/sampling.rb
 - lib/contrast/components/scope.rb
 - lib/contrast/components/security_logger.rb

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,175 +0,0 @@
-# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/agent/protect/rule/base'
-require 'contrast/components/logger'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # Encapsulate common code for protect rules that do their input analysis on agent-lib rather in ruby code
-        class BaseService < Contrast::Agent::Protect::Rule::Base
-          include Contrast::Components::Logger::InstanceMethods
-
-          def rule_name
-            'base-service'
-          end
-
-          def block_message
-            'Contrast Security Protect Rule Triggered. Response blocked.'
-          end
-
-          def prefilter context
-            return unless prefilter?(context)
-
-            ia_results = gather_ia_results(context)
-
-            ia_results.each do |ia_result|
-              result = build_attack_result(context)
-              build_attack_without_match(context, ia_result, result)
-              append_to_activity(context, result)
-
-              cef_logging(result, :successful_attack)
-              raise(Contrast::SecurityException.new(self, block_message)) if blocked?
-            end
-          end
-
-          # @param context [Contrast::Agent::RequestContext]
-          # @return [Boolean]
-          def infilter? context
-            return false unless enabled?
-            return false unless (results = gather_ia_results(context)) && results.any?
-            return false if protect_excluded_by_url?(rule_name, context.request.path)
-            return false if protect_excluded_by_input?(results, context.request.path)
-
-            true
-          end
-
-          # Base method for prefilter check. Extend if rule needs more
-          # specific conditioning.
-          #
-          # @param context [Contrast::Agent::RequestContext]
-          # @return [Boolean]
-          def prefilter? context
-            return false unless context
-            return false unless enabled?
-            return false unless (results = gather_ia_results(context)) && results.any?
-            return false if protect_excluded_by_url?(rule_name, context.request.path)
-            return false if protect_excluded_by_input?(results, context.request.path)
-
-            true
-          end
-
-          # Override for rules that need the response
-          # Currently postfilter can be applied to streamed responses, if any logic within postfilter changes to modify
-          # the response streamed responses will break
-          # @param context [Contrast::Agent::RequestContext]
-          # @raise [Contrast::SecurityException]
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-            return false if protect_excluded_by_url?(rule_name, context.request.path)
-            return if protect_excluded_by_input?(gather_ia_results(context), context.request.path)
-
-            return if mode == :NO_ACTION || mode == :PERMIT
-
-            result = find_postfilter_attacker(context, nil)
-            return unless result&.samples&.any?
-
-            cef_logging(result)
-            append_to_activity(context, result)
-            return unless result.response == :BLOCKED
-
-            raise(Contrast::SecurityException.new(self, "#{ rule_name } triggered in postfilter. Response blocked."))
-          end
-
-          protected
-
-          # Used to build and report semantic rules.
-          #
-          # @param context [Contrast::Agent::RequestContext] current request contest
-          # @param potential_attack_string [String]
-          def build_violation context, potential_attack_string
-            result = build_attack_result(context)
-            update_successful_attack_response(context, nil, result, potential_attack_string)
-            return unless result
-
-            append_sample(context, nil, result, potential_attack_string)
-            cef_logging(result, :successful_attack)
-            result
-          end
-
-          # Check to if result is blocked. Used for raise check.
-          #
-          # @param result [Contrast::Agent::Reporting::AttackResult]
-          def blocked_violation? result
-            return false unless result
-
-            result.response == Contrast::Agent::Reporting::ResponseType::BLOCKED
-          end
-
-          # @param context [Contrast::Agent::RequestContext]
-          # @return [Array<Contrast::Agent::Reporting::InputAnalysis>]
-          def gather_ia_results context
-            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless context&.agent_input_analysis&.results
-
-            context.agent_input_analysis.results.select do |ia_result|
-              ia_result.rule_id == rule_name && ia_result.score_level != Contrast::Agent::Reporting::ScoreLevel::IGNORE
-            end
-          end
-
-          def build_attack_result _context
-            result = Contrast::Agent::Reporting::AttackResult.new
-            result.rule_id = rule_name
-            result
-          end
-
-          # @param context [Contrast::Agent::RequestContext]
-          # @param potential_attack_string [String, nil]
-          # @param **kwargs
-          # @return [Contrast::Agent::Reporting]
-          def find_attacker context, potential_attack_string, **kwargs
-            ia_results = gather_ia_results(context)
-            find_attacker_with_results(context, potential_attack_string, ia_results, **kwargs)
-          end
-
-          # Allows for the InputAnalysis from Agent Library to be extracted early
-          # @param context [Contrast::Agent::RequestContext]
-          # @param potential_attack_string [String, nil]
-          # @param ia_results [Array<Contrast::Agent::Reporting::InputAnalysis>]
-          # @param **kwargs
-          # @return [Contrast::Agent::Reporting, nil]
-          def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
-            logger.trace('Checking vectors for attacks', rule: rule_name, input: potential_attack_string)
-
-            result = nil
-            ia_results.each do |ia_result|
-              if potential_attack_string
-                idx = potential_attack_string.index(ia_result.value)
-                next unless idx
-
-                result = build_attack_with_match(context, ia_result, result, potential_attack_string, **kwargs)
-              else
-                result = build_attack_without_match(context, ia_result, result, **kwargs)
-              end
-            end
-            result
-          end
-
-          private
-
-          # @param context [Contrast::Agent::RequestContext]
-          # @param potential_attack_string [String, nil]
-          # @return [Contrast::Agent::Reporting, nil]
-          def find_postfilter_attacker context, potential_attack_string, **kwargs
-            ia_results = gather_ia_results(context)
-            ia_results.select! do |ia_result|
-              ia_result.score_level == Contrast::Agent::Reporting::ScoreLevel::DEFINITEATTACK
-            end
-            find_attacker_with_results(context, potential_attack_string, ia_results, **kwargs)
-          end
-        end
-      end
-    end
-  end
-end