contrast-agent 6.6.4 → 6.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15953528d5e347bd018a0e448e2653107c782481cc3df1e6513fc52641d52900
-  data.tar.gz: c7bec86c862f372a1e2e3804a129cef4eb2d7ebc18115c7b829ba31080d4553f
+  metadata.gz: 2c32847e196cdcf1540bd39373f9327a46e50cb1c4be6516f2ad5664696c0221
+  data.tar.gz: 03b9bc37cf6b8fe3fd0662f120f6f24cc9faf868cf91c7fb698ccbcb52f15aac
 SHA512:
-  metadata.gz: b7de9ceb2ed80201d5c74aea212b652c86999b58c20693c5e2d1e233684c1ee54f1d2f56a3cdba20e374b22f35b89d231eec3a486325f7dde183a3ac0c9e114f
-  data.tar.gz: ce3fa2a7ae5021eb60978696254f7b0331f5d7c1d75bb697d423403e7fe2071aea5b66660875afe555a3ad101e8a121b546a3f9d5c7423833bc21a10c8cb4406
+  metadata.gz: 204a13ebf2cc20d9302d55a1d2201cc0f8f2ba35b5bf1b3392f75c0636f8ab5224de54106af8349c16da111d86f2381e894d8925eccf2df1e46e4d04b99eb7be
+  data.tar.gz: ac50424a98754b82bab6576b7205cdb3f6243f5dc6aa9c55f817f15cfba61e1f0858c27a66efd18457442f0b4f2e8ea42cdfcbecdd67c6941edcd86c77b11164

data/.gitignore

@@ -21,7 +21,9 @@
 bin
 ruby-spec
 mspec
-service_executables
+
+# rspec generated files
+/spec/dummy_files/*
 
 # Funchook artifacts
 /ext/**/funchook.h
@@ -54,7 +56,6 @@ contrast-agent-*.gem
 
 .ruby-version
 .ruby-gemset
-service_executables/*-*
 
 # IDE stuff
 tags

data/.gitmodules

@@ -1,6 +1,3 @@
-[submodule "agent-service-api"]
-	path = agent-service-api
-	url = git@github.com:Contrast-Security-Inc/agent-service-api.git
 [submodule "funchook"]
 	path = funchook
 	url = https://github.com/kubo/funchook.git

data/.simplecov

@@ -4,6 +4,5 @@
 SimpleCov.minimum_coverage(line: 94)
 SimpleCov.start do
   add_filter '/spec/'
-  add_filter '/lib/protobuf/'
   enable_coverage :branch
 end

data/Rakefile

@@ -6,7 +6,6 @@ $stdout.sync = true
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rake/extensiontask'
-load 'protobuf/tasks/compile.rake'
 require 'fileutils'
 
 CLOBBER << 'shared_libraries/*'

data/ext/cs__assess_array/cs__assess_array.c

@@ -31,15 +31,46 @@ static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
     return result;
 }
 
+static VALUE contrast_assess_prepend_array_join(const int argc, const VALUE *argv,
+                                        const VALUE ary) {
+    VALUE sep, result;
+    /* We need to figure out the separator the join method actually used. */
+    /* First, check if one was provided. */
+    rb_scan_args(argc, argv, "01", &sep);
+    /* Second, check to see if `$;` is set*/
+    if (NIL_P(sep)) {
+        sep = rb_output_fs;
+    }
+
+    /* call the Array.join but patched one */
+    result = rb_ary_join(ary, sep);
+    /* call the Contrast::Extensions::Assess::ArrayPropagator#cs__track_join */
+    result = rb_funcall(array_propagator, rb_sym_assess_track_array_join, 3,
+                        ary, sep, result);
+
+    /*call original occurs in ruby*/
+    return Qtrue;
+}
+
 void Init_cs__assess_array(void) {
-    array_propagator =
-        rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
-    rb_sym_assess_track_array_join = rb_intern("cs__track_join");
-    /*
-     * Here we need to check before using the alias or prepend spec
-     * This patch is happening here, we register the cs__track_join
-     * method of the Array propagator, and call it here from Ruby.
-     */
-    rb_sym_assess_array_join =
-        contrast_register_patch("Array", "join", contrast_assess_array_join);
+
+     VALUE rb_mod_ary = rb_const_get(rb_cObject, rb_intern("Array"));
+     VALUE rb_sym_ary_join = ID2SYM(rb_intern("join"));
+     // check if prepended
+     VALUE is_prepended = contrast_check_prepended(rb_mod_ary, rb_sym_ary_join, Qtrue);
+     // register the cs__track_join method of the Array propagator, and call it here from Ruby.
+     array_propagator = rb_define_class_under(core_assess, "ArrayPropagator", rb_cObject);
+     rb_sym_assess_track_array_join = rb_intern("cs__track_join");
+
+     // register the cs__join method of the ContrastArray for prepending, and call it here from Ruby.
+     VALUE contrast_array = rb_define_module_under(core_assess, "ContrastArray");
+     rb_define_module_function(contrast_array, "cs__join", contrast_assess_prepend_array_join, -1);
+
+    if(is_prepended == Qtrue) {
+       // do nothing prepend is done in Ruby
+    } else {
+       // register alias patch
+        rb_sym_assess_array_join =
+            contrast_register_patch("Array", "join", contrast_assess_array_join);
+    }
 }

data/ext/cs__assess_array/cs__assess_array.h

@@ -3,8 +3,11 @@
 static VALUE array_propagator;
 static VALUE rb_sym_assess_array_join;
 static VALUE rb_sym_assess_track_array_join;
-
+static VALUE rb_mod_ary, rb_sym_ary_join, is_prepended, contrast_array;
 static VALUE contrast_assess_array_join(const int argc, const VALUE *argv,
                                         const VALUE ary);
 
+static VALUE contrast_assess_prepend_array_join(const int argc, const VALUE *argv,
+                                        const VALUE ary);
+
 void Init_cs__assess_array(void);

data/ext/cs__scope/cs__scope.c

@@ -81,7 +81,7 @@ void rb_raise_scope_no_method_err(const VALUE method_scope_sym) {
  * sets scope instance variables.
  * def initialize
  *    @contrast_scope = 0
- *     @deserialization_scope = 0
+ *    @deserialization_scope = 0
  *    @split_scope = 0
  * end
  */

data/lib/contrast/agent/assess/contrast_event.rb

@@ -9,6 +9,7 @@ require 'contrast/utils/stack_trace_utils'
 require 'contrast/utils/string_utils'
 require 'contrast/utils/timer'
 require 'contrast/agent/assess/contrast_object'
+require 'contrast/agent/reporting/reporting_events/finding_event'
 
 module Contrast
   module Agent
@@ -63,34 +64,11 @@ module Contrast
           capture_stacktrace!
         end
 
+        # @return [Array<Contrast::Agent::Assess::ContrastEvent>]
         def parent_events
           @_parent_events ||= []
         end
 
-        # We have to do a little work to figure out what our TS appropriate target is. To break this down, the logic is
-        # as follows:
-        # 1) If my policy_node has a target, work on targets. Else, work on sources. Per TS law, each policy_node must
-        #    have at least a source or a target. The only type of policy_node w/o targets is a Trigger, but that may
-        #    change.
-        # 2) I'll set the event's source and target to TS values.
-        # 3) Return the first source/target as the taint target.
-        def determine_taint_target event_dtm
-          if @policy_node&.targets&.any?
-            event_dtm.source = @policy_node.source_string if @policy_node.source_string
-            event_dtm.target = @policy_node.target_string
-            @policy_node.targets[0]
-          elsif policy_node&.sources&.any?
-            event_dtm.source = @policy_node.source_string
-            event_dtm.target = @policy_node.target_string if @policy_node.target_string
-            @policy_node.sources[0]
-          end
-        end
-
-        # Convert this event into a DTM that TeamServer can consume
-        def to_dtm_event
-          Contrast::Api::Dtm::TraceEvent.build(self)
-        end
-
         private
 
         # Parent events are the events of all the sources of this event which were tracked prior to this event

data/lib/contrast/agent/assess/events/source_event.rb

@@ -2,7 +2,8 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/contrast_event'
-require 'contrast/agent/reporting/reporting_events/trace_event_source'
+require 'contrast/agent/reporting/reporting_events/finding_event'
+require 'contrast/agent/reporting/reporting_events/finding_event_source'
 require 'contrast/utils/string_utils'
 
 module Contrast
@@ -19,6 +20,8 @@ module Contrast
           attr_reader :source_name
           # @return [String] the TeamServer understood type of source; i.e. parameter
           attr_reader :source_type
+          # @return [Contrast::Agent::Reporting::FindingEventSource] the source of this trace
+          attr_reader :event_source
 
           # @param event_data [Contrast::Agent::Assess::Events::EventData]
           # @param source_type [String] the type of this source, from the source_node, or a KEY_TYPE if invoked for a
@@ -27,72 +30,15 @@ module Contrast
           #   nil if a type like
           def initialize event_data, source_type = nil, source_name = nil
             super(event_data)
-            @source_type = source_type
-            @source_name = source_name
+            @source_type = Contrast::Utils::StringUtils.force_utf8(source_type)
+            @source_name = Contrast::Utils::StringUtils.force_utf8(source_name)
+            @event_source = Contrast::Agent::Reporting::FindingEventSource.new(@source_type, @source_name)
             @request = Contrast::Agent::REQUEST_TRACKER.current&.request
           end
 
           def parent_events
             nil
           end
-
-          # Convert this event into a DTM that TeamServer can consume
-          def to_dtm_event
-            event = super
-            event.field_name = Contrast::Utils::StringUtils.force_utf8(source_name)
-            event_source_dtm = build_event_source_dtm
-            event.event_sources << event_source_dtm if event_source_dtm
-            event.object_id = event_id.to_i
-            event
-          end
-
-          def forced_source_type
-            @_forced_source_type ||= Contrast::Utils::StringUtils.force_utf8(source_type)
-          end
-
-          def forced_source_name
-            @_forced_source_name ||= Contrast::Utils::StringUtils.force_utf8(source_name)
-          end
-
-          # Probably only for source events, but we'll go with source_type instead. java & .net support source_type
-          # in propagation events, so we'll future proof this
-          #
-          # @return [Contrast::Agent::Reporting::TraceEventSource, nil]
-          def build_event_source
-            # You can have a source w/o a name, but not w/o a type
-            return unless source_type
-
-            trace_event_source = Contrast::Agent::Reporting::TraceEventSource.new
-            trace_event_source.type = forced_source_type
-            trace_event_source.name = forced_source_name
-            trace_event_source
-          end
-
-          # We have to do a little work to figure out what our TS appropriate target is. To break this down, the logic
-          # is as follows:
-          # 1) I'll set the event's source and target to TS values.
-          # 2) Return the first source/target as the taint target.
-          def determine_taint_target event_dtm
-            return unless @policy_node&.targets&.any?
-
-            event_dtm.source = @policy_node.source_string if @policy_node.source_string
-            event_dtm.target = @policy_node.target_string
-            @policy_node.targets[0]
-          end
-
-          private
-
-          # Probably only for source events, but we'll go with source_type instead. java & .net support source_type
-          # in propagation events, so we'll future proof this
-          def build_event_source_dtm
-            # You can have a source w/o a name, but not w/o a type
-            return unless source_type
-
-            dtm = Contrast::Api::Dtm::TraceEventSource.new
-            dtm.type = forced_source_type
-            dtm.name = forced_source_name
-            dtm
-          end
         end
       end
     end

data/lib/contrast/agent/assess/finalizers/hash.rb

@@ -10,8 +10,11 @@ module Contrast
       module Finalizers
         # An extension of Hash that doesn't impact GC of the object being stored by storing its ID as a Key to lookup
         # and registering a finalizer on the object to remove its entry from the Hash immediately after it's GC'd.
+        #
+        # NOTE: PROPERTIES_HASH is called from C
         class Hash < Hash
           FROZEN_FINALIZED_IDS = Set.new
+          KEEP_AGE = 600_000.cs__freeze # 10 minutes
 
           def []= key, obj
             return unless obj
@@ -89,6 +92,14 @@ module Contrast
           rescue StandardError => _e
             nil
           end
+
+          def cleanup!
+            ids = keys.dup
+            ids.each do |key|
+              properties = fetch(key.__id__, nil)
+              delete(key) unless properties&.event && (Contrast::Utils::Timer.now_ms - properties.event.time) < KEEP_AGE
+            end
+          end
         end
       end
     end

data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb

@@ -44,11 +44,6 @@ module Contrast
                 Contrast::Agent::Assess::Policy::Policy.instance.add_node(dynamic_source_node, :dynamic_source)
                 method_policy = build_source_policy(method_name, dynamic_source_node)
                 Contrast::Agent::Patching::Policy::Patcher.patch_method(klass, instance_methods, method_policy)
-                next unless current_context
-
-                dynamic_source = create_dynamic_source(current_request, dynamic_source_node, field, properties)
-                node_id = Contrast::Utils::StringUtils.force_utf8(dynamic_source_node.id)
-                current_context.activity.dynamic_sources[node_id] = dynamic_source
               end
             end
 
@@ -97,56 +92,6 @@ module Contrast
                                                                       source_node: dynamic_source_node
                                                                   })
             end
-
-            # @param request [Contrast::Agent::Request] the request during
-            #   which this source is to be created.
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
-            #   the SourceNode that applies to this method
-            # @param field [String] the name of the method to which this source
-            #   applies
-            # @param properties [Contrast::Agent::Assess::Properties] the
-            #   properties which this source should relate to the data tracked
-            #   as a result of this Source Method
-            # @return [Contrast::Api::Dtm::DynamicSource] the message to send
-            #   to the Service to allow it to report the events leading up to
-            #   the creation of the Dynamic Source
-            def create_dynamic_source request, source_node, field, properties
-              dynamic_source = Contrast::Api::Dtm::DynamicSource.new
-              dynamic_source.class_name = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
-              dynamic_source.method_name = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.instance_method = source_node.instance_method?
-              dynamic_source.target = Contrast::Utils::StringUtils.force_utf8(source_node.target_string)
-              append_properties!(dynamic_source, request, source_node, field)
-              append_events!(dynamic_source, properties.event)
-              dynamic_source
-            end
-
-            # Append the properties needed to reconstruct the given DynamicSource in other dataflows and for rendering
-            # in TeamServer
-            #
-            # @param dynamic_source [Contrast::Api::Dtm::DynamicSource] the message to send to the Service to allow it
-            #   to report the events leading up to the creation of the Dynamic Source.
-            # @param request [Contrast::Agent::Request] the request during which this source is to be created.
-            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode] the SourceNode that applies to this
-            #   method.
-            # @param field [String] the name of the method to which this source applies.
-            def append_properties! dynamic_source, request, source_node, field
-              dynamic_source.properties[READ_TABLE] = Contrast::Utils::StringUtils.force_utf8(source_node.class_name)
-              dynamic_source.properties[READ_COLUMN] = Contrast::Utils::StringUtils.force_utf8(field)
-              dynamic_source.properties[WRITE_QUERY_TIME] =
-                Contrast::Utils::StringUtils.force_utf8(Contrast::Utils::Timer.now_ms)
-              dynamic_source.properties[WRITE_QUERY_URL] =
-                Contrast::Utils::StringUtils.force_utf8(request&.normalized_uri)
-            end
-
-            def append_events! dynamic_source, event
-              return unless event
-
-              event.parent_events&.each do |parent_event|
-                append_events(dynamic_source, parent_event)
-              end
-              dynamic_source.events << event.to_dtm_event
-            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/policy_node.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'
-require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
 require 'contrast/utils/object_share'
 require 'contrast/agent/assess/policy/policy_node_utils'
 require 'contrast/components/logger'
@@ -123,8 +123,8 @@ module Contrast
             return unless tags
 
             tags.each do |tag|
-              next if Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag) ||
-                  Contrast::Api::Decorators::TraceTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
+              next if Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag) ||
+                  Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
 
               raise(ArgumentError, "#{ node_class } #{ id } had an invalid tag. #{ tag } is not a known value.")
             end

data/lib/contrast/agent/assess/policy/policy_node_utils.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/patching/policy/policy_node'
-require 'contrast/api/decorators/trace_taint_range_tags'
 require 'contrast/utils/object_share'
 
 module Contrast

data/lib/contrast/agent/assess/policy/propagation_node.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/agent/assess/policy/policy_node'
-require 'contrast/api/decorators/trace_taint_range_tags'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
 require 'contrast/components/logger'
 
 module Contrast
@@ -22,8 +22,8 @@ module Contrast
           JSON_PATCH_CLASS = 'patch_class'
           JSON_PATCH_METHOD = 'patch_method'
 
-          attr_reader :untags, :patch_method
-          attr_accessor :action, :patch_class
+          attr_reader :action, :untags, :patch_method
+          attr_accessor :patch_class
 
           TAGGER = 'Tagger'
           PROPAGATOR = 'Propagator'
@@ -90,7 +90,7 @@ module Contrast
             return unless untags
 
             untags.each do |tag|
-              unless Contrast::Api::Decorators::TraceTaintRangeTags::VALID_TAGS.include?(tag)
+              unless Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag)
                 raise(ArgumentError,
                       "#{ node_type } #{ id } did not have a valid untag. #{ tag } is not a known value.")
               end

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -3,6 +3,7 @@
 
 require 'set'
 require 'contrast/agent/assess/policy/source_validation/source_validation'
+require 'contrast/agent/excluder'
 require 'contrast/components/logger'
 require 'contrast/utils/object_share'
 require 'contrast/utils/sha256_builder'
@@ -28,6 +29,8 @@ module Contrast
           HEADER_KEY_TYPE    = 'HEADER_KEY'
           COOKIE_TYPE        = 'COOKIE'
           COOKIE_KEY_TYPE    = 'COOKIE_KEY'
+          BODY_TYPE          = 'BODY'
+          QUERYSTRING_TYPE   = 'QUERYSTRING'
 
           class << self
             # This is called from within our woven proc. It will be called as if it were inline in the Rack application.
@@ -42,6 +45,7 @@ module Contrast
                 return unless analyze?(method_policy, object, ret, args)
                 return if event_limit?(method_policy)
                 return unless (source_node = method_policy.source_node)
+                return if excluded_by_url?
 
                 # used to hold the object and ret
                 source_data = Contrast::Agent::Assess::Events::EventData.new(nil, nil, object, ret, nil)
@@ -66,13 +70,16 @@ module Contrast
             # @param source_name [String, nil] the name of this source, i.e. the key used to accessed if from a map or
             #   nil if a type like BODY
             # @param args [Array<Object>] the Arguments with which the method was invoked
-            def process_source source_node, target, source_data, source_type, source_name = nil, *args
+            def process_source source_node, target, source_data, source_type, source_name = nil, *args # rubocop:disable Metrics/PerceivedComplexity
               context = Contrast::Agent::REQUEST_TRACKER.current
               return unless context && source_node && target
 
               increment_event_count(source_node)
 
               source_name ||= determine_source_name(source_node, source_data.object, source_data.ret, *args)
+
+              return if excluded_by_input?(source_type, source_name)
+
               # We know we only work on certain things.
               # Skip if this isn't one of them
               if Contrast::Agent::Assess::Tracker.trackable?(target)
@@ -177,6 +184,22 @@ module Contrast
                 source_type
               end
             end
+
+            # Should a source be excluded because it matches one of the input exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_input? source_type, source_name
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_input?(context.request, source_type, source_name)
+            end
+
+            # Should a source be excluded because it matches one of the url exclusion rules?
+            #
+            # @return [Boolean]
+            def excluded_by_url?
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              Contrast::SETTINGS.excluder.assess_excluded_by_url?(context.request)
+            end
           end
         end
       end

data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb

@@ -38,6 +38,7 @@ module Contrast
                                                                             ret,
                                                                             interpolated_inputs)
                 properties.build_event(event_data)
+                properties.copy_from(erb_template_prerender, ret, 0)
                 unless interpolated_inputs.empty?
                   current_event = properties.event
                   interpolated_inputs.each do |input|
@@ -49,11 +50,12 @@ module Contrast
                 end
 
                 if Contrast::Agent::Assess::Tracker.tracked?(ret)
-                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
-                                                                               ret,
-                                                                               erb_template_prerender,
-                                                                               ret,
-                                                                               interpolated_inputs)
+                  finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                         ret,
+                                                                                         erb_template_prerender,
+                                                                                         ret,
+                                                                                         interpolated_inputs)
+                  Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
                 end
 
                 ret

data/lib/contrast/agent/assess/policy/trigger/xpath.rb

@@ -38,7 +38,12 @@ module Contrast
                   next unless Contrast::Agent::Assess::Tracker.tracked?(arg)
                   next unless trigger_node.violated?(arg)
 
-                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node, arg, object, ret, *args)
+                  finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                         arg,
+                                                                                         object,
+                                                                                         ret,
+                                                                                         *args)
+                  Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
                 end
 
                 ret