contrast-agent 6.6.1 → 6.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ba6de8e82da25931f2fd6d90f515451c33521c02c0fd00e0120ea05701bdc23
-  data.tar.gz: 953297f4f0908bcdcf4791f91869dcf69312f44fe05e743e1e681ce9d3aa9b6f
+  metadata.gz: f00aee3e36cdb303ca9b209824fbb92386e0ca0043c0f24377f79168dca8d252
+  data.tar.gz: 7fc3d7571246ff92a10da151ce4b723768e3f7214b5a1e57d5bb1d6a66e86e2b
 SHA512:
-  metadata.gz: f7e96583d53e23400fd53fd24aed86c728e0d9b8d79a17179cc1bb96a50ad002e047805b10cea0eaa362802c494ff0b45463a16b53a008e9921723cd9e6e43f9
-  data.tar.gz: f3c7c2a5b575233f4f8d3e9058b281352133625ab42d50b3c6590c7178728ceda8c494953890a0d50e1413ad5f1e50c04595cc035d5f3ed247611f3a1401095e
+  metadata.gz: 9fc9e69602a2706cb41bf8d13e07693afb61ad85ad03ff43182f3c79c5f9dff1c0b8ed3e0cb690d15cf8e43830920516604e9b497945963897f0ee1b82e11f9b
+  data.tar.gz: dfd4e5146f9ac498b83d76b13a9d6ed17a5de0e659ed301acbf6a873e18d5ff75ea8aa8fa7c3789433e100903a9f6bfb4b87c9d283107c5bd04015f862e88644

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -20,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
   # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
   # :STATE_SKIP_NEXT_CHARACTER
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the index of the input in the query
+  # @param input [String] the input value provided by the user
+  # @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
   def crosses_boundary query, index, input
     last_boundary = 0
-    token_boundaries(query).each do |boundary|
+    scan_token_boundaries(query).each do |boundary|
       if boundary > index
-        return last_boundary, boundary if boundary < index + input.length
+        # We should report the previous and overrun boundary if the input crosses one.
+        return last_boundary, boundary if boundary < (index + input.length)
 
         break
       end
@@ -33,10 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     nil
   end
 
-  def token_boundaries query
-    @_token_boundaries ||= scan_token_boundaries(query)
-  end
+  private
 
+  # @param query [String] the query being executed
+  # @return [Array<Integer>] the boundaries of the query
   def scan_token_boundaries query
     boundaries = []
     return boundaries unless query && !query.empty?
@@ -73,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     boundaries
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param current_state [Symbol] the state of the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_state boundaries, current_state, char, index, query
     case current_state
     when :STATE_EXPECTING_TOKEN
@@ -88,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_expecting_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -112,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_inside_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -133,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param _query [String] the query being executed
   def process_number boundaries, char, index, _query
     if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
       :STATE_INSIDE_NUMBER
@@ -142,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_double_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -159,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_single_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -176,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def double_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def single_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_escape_sequence_boundary query, index
     idx = index
     while idx < query.length
@@ -199,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_block_comment_boundary query, index
     idx = index
     while idx < query.length
@@ -210,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_new_line_boundary query, index
     idx = index
     while idx < query.length
@@ -222,12 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param char [String] the character being evaluated
   def operator? char
     char.match?(OPERATOR_PATTERN)
   end
 
   # @note: Any class extending this module should override these methods as needed
   # Are the current and subsequent characters both '-' ?
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_line_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::DASH
     return false unless (query.length - 2) >= index
@@ -237,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the start of a block comment
   # We assume '/*' starts the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::SLASH
     return false unless (query.length - 2) >= index
@@ -246,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the end of a block comment
   # We assume '*/' ends the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def end_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::ASTERISK
     return false unless (query.length - 2) >= index
@@ -267,18 +320,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the character provided an escape character?
   # By default, we'll assume
+  #
+  # @param char [String] the character being evaluated
   def escape_char? char
     char == Contrast::Utils::ObjectShare::BACK_SLASH
   end
 
   # Is this the start of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_start? _char
     false
   end
 
   # Is this the end of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_end? _char
     false
   end

data/lib/contrast/agent/protect/rule/sql_sample_builder.rb

@@ -65,8 +65,8 @@ module Contrast
             #   if one exists, in the case of multiple inputs being found to violate the protection criteria
             # @param result [Contrast::Api::Dtm::AttackResult, nil] previous attack result for this rule, if one exists,
             #   in the case of multiple inputs being found to violate the protection criteria
-            # @query_string [string] he value of the input which may be an attack
-            # @kwargs [Hash] key - value pairs of context individual rules need to build out details to send
+            # @param query_string [String] the value of the input which may be an attack
+            # @param kwargs [Hash] key - value pairs of context individual rules need to build out details to send
             #   to the Service to tell the story of the attack
             # @return [Contrast::Api::Dtm::AttackResult] the result from this attack
             def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
@@ -86,14 +86,12 @@ module Contrast
               ss = StringScanner.new(query_string)
               length = attack_string.length
               while ss.scan_until(regexp)
-                # the pos of StringScanner is at the end of the regexp (input string),
-                # we need the beginning
+                # the pos of StringScanner is at the end of the regexp (input string), we need the beginning
                 idx = ss.pos - attack_string.length
                 last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
                 next unless last_boundary && boundary
 
                 result ||= build_attack_result(context)
-
                 record_match(idx, length, boundary, last_boundary, kwargs)
                 append_match(context, input_analysis_result, result, query_string, **kwargs)
               end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '6.6.1'
+    VERSION = '6.6.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.6.1
+  version: 6.6.2
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-07-13 00:00:00.000000000 Z
+date: 2022-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler