contrast-agent 6.6.4 → 6.8.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +3 -2
- data/.gitmodules +0 -3
- data/.simplecov +0 -1
- data/Rakefile +0 -1
- data/ext/cs__assess_array/cs__assess_array.c +41 -10
- data/ext/cs__assess_array/cs__assess_array.h +4 -1
- data/ext/cs__scope/cs__scope.c +1 -1
- data/lib/contrast/agent/assess/contrast_event.rb +2 -24
- data/lib/contrast/agent/assess/events/source_event.rb +7 -61
- data/lib/contrast/agent/assess/finalizers/hash.rb +11 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +0 -55
- data/lib/contrast/agent/assess/policy/policy_node.rb +3 -3
- data/lib/contrast/agent/assess/policy/policy_node_utils.rb +0 -1
- data/lib/contrast/agent/assess/policy/propagation_node.rb +4 -4
- data/lib/contrast/agent/assess/policy/source_method.rb +24 -1
- data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +7 -5
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +6 -1
- data/lib/contrast/agent/assess/policy/trigger_method.rb +40 -121
- data/lib/contrast/agent/assess/policy/trigger_node.rb +3 -3
- data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -1
- data/lib/contrast/agent/assess/property/evented.rb +2 -12
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +42 -82
- data/lib/contrast/agent/assess/rule/response/base_rule.rb +11 -27
- data/lib/contrast/agent/assess/rule/response/body_rule.rb +1 -3
- data/lib/contrast/agent/assess/rule/response/cache_control_header_rule.rb +77 -62
- data/lib/contrast/agent/assess/rule/response/csp_header_insecure_rule.rb +1 -1
- data/lib/contrast/agent/assess/rule/response/framework/rails_support.rb +6 -1
- data/lib/contrast/agent/assess/rule/response/header_rule.rb +5 -5
- data/lib/contrast/agent/assess/rule/response/hsts_header_rule.rb +1 -1
- data/lib/contrast/agent/assess/rule/response/x_xss_protection_header_rule.rb +1 -1
- data/lib/contrast/agent/assess/tracker.rb +1 -7
- data/lib/contrast/agent/at_exit_hook.rb +1 -7
- data/lib/contrast/agent/excluder.rb +224 -0
- data/lib/contrast/agent/exclusion_matcher.rb +25 -7
- data/lib/contrast/agent/inventory/database_config.rb +18 -23
- data/lib/contrast/agent/middleware.rb +4 -5
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -0
- data/lib/contrast/agent/protect/input_analyzer/input_analyzer.rb +146 -127
- data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +4 -0
- data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +20 -0
- data/lib/contrast/agent/protect/policy/applies_sqli_rule.rb +1 -0
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
- data/lib/contrast/agent/protect/rule/base.rb +98 -66
- data/lib/contrast/agent/protect/rule/base_service.rb +49 -24
- data/lib/contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification.rb +98 -0
- data/lib/contrast/agent/protect/rule/bot_blocker.rb +81 -0
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +30 -99
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_backdoors.rb +132 -0
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb +169 -0
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb +69 -0
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb +68 -0
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb +2 -58
- data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
- data/lib/contrast/agent/protect/rule/deserialization.rb +10 -19
- data/lib/contrast/agent/protect/rule/http_method_tampering/http_method_tampering_input_classification.rb +2 -2
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +0 -11
- data/lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb +29 -34
- data/lib/contrast/agent/protect/rule/no_sqli.rb +25 -18
- data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb +61 -0
- data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb +114 -0
- data/lib/contrast/agent/protect/rule/path_traversal.rb +46 -18
- data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +49 -29
- data/lib/contrast/agent/protect/rule/sqli/sqli_base_rule.rb +37 -0
- data/lib/contrast/agent/protect/rule/sqli/sqli_input_classification.rb +2 -62
- data/lib/contrast/agent/protect/rule/sqli/sqli_semantic/sqli_dangerous_functions.rb +67 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +67 -22
- data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification.rb +39 -63
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +6 -33
- data/lib/contrast/agent/protect/rule/xss/reflected_xss_input_classification.rb +58 -0
- data/lib/contrast/agent/protect/rule/xss.rb +14 -20
- data/lib/contrast/agent/protect/rule/xxe.rb +15 -30
- data/lib/contrast/agent/protect/rule.rb +3 -1
- data/lib/contrast/agent/reporting/attack_result/attack_result.rb +8 -0
- data/lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb +70 -36
- data/lib/contrast/agent/reporting/attack_result/response_type.rb +9 -9
- data/lib/contrast/agent/reporting/attack_result/user_input.rb +11 -0
- data/lib/contrast/agent/reporting/details/bot_blocker_details.rb +29 -0
- data/lib/contrast/agent/reporting/details/cmd_injection_details.rb +30 -0
- data/lib/contrast/agent/reporting/details/details.rb +18 -0
- data/lib/contrast/agent/reporting/details/http_method_tempering_details.rb +27 -0
- data/lib/contrast/agent/reporting/details/ip_denylist_details.rb +35 -0
- data/lib/contrast/agent/reporting/details/no_sqli_details.rb +36 -0
- data/lib/contrast/agent/reporting/details/path_traversal_details.rb +24 -0
- data/lib/contrast/agent/reporting/details/path_traversal_semantic_analysis_details.rb +32 -0
- data/lib/contrast/agent/reporting/details/protect_rule_details.rb +17 -0
- data/lib/contrast/agent/reporting/details/sqli_dangerous_functions.rb +22 -0
- data/lib/contrast/agent/reporting/details/sqli_details.rb +36 -0
- data/lib/contrast/agent/reporting/details/untrusted_deserialization_details.rb +27 -0
- data/lib/contrast/agent/reporting/details/virtual_patch_details.rb +30 -0
- data/lib/contrast/agent/reporting/details/xss_details.rb +33 -0
- data/lib/contrast/agent/reporting/details/xss_match.rb +30 -0
- data/lib/contrast/agent/reporting/details/xxe_details.rb +36 -0
- data/lib/contrast/agent/reporting/details/xxe_match.rb +25 -0
- data/lib/contrast/agent/reporting/details/xxe_wrapper.rb +25 -0
- data/lib/contrast/agent/reporting/input_analysis/details/bot_blocker_details.rb +27 -0
- data/lib/contrast/agent/reporting/input_analysis/details/protect_rule_details.rb +15 -0
- data/lib/contrast/agent/reporting/input_analysis/input_analysis.rb +1 -2
- data/lib/contrast/agent/reporting/input_analysis/input_analysis_result.rb +17 -3
- data/lib/contrast/agent/reporting/masker/masker.rb +80 -65
- data/lib/contrast/agent/reporting/masker/masker_utils.rb +1 -30
- data/lib/contrast/agent/reporting/reporter.rb +1 -15
- data/lib/contrast/agent/reporting/reporting_events/agent_startup.rb +2 -2
- data/lib/contrast/agent/reporting/reporting_events/application_activity.rb +84 -15
- data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb +13 -25
- data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb +19 -24
- data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb +46 -126
- data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity.rb +5 -16
- data/lib/contrast/agent/reporting/reporting_events/application_defend_attacker_activity.rb +10 -18
- data/lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb +6 -14
- data/lib/contrast/agent/reporting/reporting_events/application_startup.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_events/application_update.rb +0 -2
- data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +7 -22
- data/lib/contrast/agent/reporting/reporting_events/finding.rb +23 -53
- data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +12 -9
- data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +23 -21
- data/lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb +5 -18
- data/lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb +1 -0
- data/lib/contrast/{api/decorators/trace_taint_range_tags.rb → agent/reporting/reporting_events/finding_event_taint_range_tags.rb} +7 -6
- data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +40 -10
- data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +0 -1
- data/lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +2 -2
- data/lib/contrast/agent/reporting/reporting_events/poll.rb +1 -11
- data/lib/contrast/agent/reporting/reporting_events/preflight_message.rb +10 -14
- data/lib/contrast/agent/reporting/reporting_events/reporting_event.rb +11 -0
- data/lib/contrast/agent/reporting/reporting_events/route_coverage.rb +3 -1
- data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +12 -25
- data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +8 -27
- data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +3 -3
- data/lib/contrast/agent/reporting/reporting_utilities/build_preflight.rb +4 -7
- data/lib/contrast/agent/reporting/reporting_utilities/headers.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +2 -1
- data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +3 -3
- data/lib/contrast/agent/reporting/reporting_utilities/response.rb +1 -1
- data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +0 -3
- data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +1 -0
- data/lib/contrast/agent/reporting/settings/code_exclusion.rb +6 -1
- data/lib/contrast/agent/reporting/settings/exclusion_base.rb +18 -0
- data/lib/contrast/agent/reporting/settings/exclusions.rb +2 -1
- data/lib/contrast/agent/reporting/settings/input_exclusion.rb +9 -3
- data/lib/contrast/agent/reporting/settings/protect.rb +15 -15
- data/lib/contrast/agent/request.rb +4 -14
- data/lib/contrast/agent/request_context.rb +18 -24
- data/lib/contrast/agent/request_context_extend.rb +23 -164
- data/lib/contrast/agent/request_handler.rb +1 -11
- data/lib/contrast/agent/response.rb +0 -18
- data/lib/contrast/agent/telemetry/events/event.rb +1 -1
- data/lib/contrast/agent/telemetry/events/metric_event.rb +1 -1
- data/lib/contrast/agent/telemetry/events/startup_metrics_event.rb +3 -3
- data/lib/contrast/agent/thread_watcher.rb +3 -18
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/agent.rb +0 -11
- data/lib/contrast/agent_lib/api/command_injection.rb +46 -0
- data/lib/contrast/agent_lib/api/init.rb +101 -0
- data/lib/contrast/agent_lib/api/input_tracing.rb +267 -0
- data/lib/contrast/agent_lib/api/method_tempering.rb +29 -0
- data/lib/contrast/agent_lib/api/panic.rb +87 -0
- data/lib/contrast/agent_lib/api/path_semantic_file_security_bypass.rb +40 -0
- data/lib/contrast/agent_lib/interface.rb +260 -0
- data/lib/contrast/agent_lib/interface_base.rb +118 -0
- data/lib/contrast/agent_lib/return_types/eval_result.rb +44 -0
- data/lib/contrast/agent_lib/test.rb +29 -0
- data/lib/contrast/api/communication/connection_status.rb +5 -5
- data/lib/contrast/components/agent.rb +13 -23
- data/lib/contrast/components/api.rb +10 -10
- data/lib/contrast/components/app_context.rb +9 -11
- data/lib/contrast/components/app_context_extend.rb +1 -26
- data/lib/contrast/components/assess.rb +92 -38
- data/lib/contrast/components/assess_rules.rb +36 -0
- data/lib/contrast/components/config.rb +49 -24
- data/lib/contrast/components/heap_dump.rb +1 -1
- data/lib/contrast/components/protect.rb +9 -6
- data/lib/contrast/components/ruby_component.rb +81 -0
- data/lib/contrast/components/sampling.rb +1 -1
- data/lib/contrast/components/security_logger.rb +23 -0
- data/lib/contrast/components/settings.rb +41 -85
- data/lib/contrast/config/base_configuration.rb +1 -1
- data/lib/contrast/config/protect_rule_configuration.rb +7 -7
- data/lib/contrast/config/protect_rules_configuration.rb +24 -48
- data/lib/contrast/config/server_configuration.rb +1 -1
- data/lib/contrast/config.rb +0 -6
- data/lib/contrast/configuration.rb +73 -18
- data/lib/contrast/extension/assess/array.rb +9 -0
- data/lib/contrast/extension/assess/exec_trigger.rb +3 -1
- data/lib/contrast/extension/assess/marshal.rb +3 -2
- data/lib/contrast/extension/assess/string.rb +0 -1
- data/lib/contrast/extension/delegator.rb +2 -0
- data/lib/contrast/extension/extension.rb +1 -1
- data/lib/contrast/framework/base_support.rb +0 -5
- data/lib/contrast/framework/grape/support.rb +1 -23
- data/lib/contrast/framework/manager.rb +3 -11
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -6
- data/lib/contrast/framework/rails/railtie.rb +0 -1
- data/lib/contrast/framework/rails/support.rb +5 -59
- data/lib/contrast/framework/sinatra/support.rb +2 -21
- data/lib/contrast/logger/cef_log.rb +21 -3
- data/lib/contrast/logger/log.rb +1 -11
- data/lib/contrast/tasks/config.rb +5 -10
- data/lib/contrast/utils/assess/event_limit_utils.rb +28 -12
- data/lib/contrast/utils/assess/trigger_method_utils.rb +10 -18
- data/lib/contrast/utils/duck_utils.rb +1 -0
- data/lib/contrast/utils/findings.rb +6 -5
- data/lib/contrast/utils/hash_digest.rb +9 -24
- data/lib/contrast/utils/hash_digest_extend.rb +6 -6
- data/lib/contrast/utils/input_classification_base.rb +156 -0
- data/lib/contrast/utils/invalid_configuration_util.rb +21 -58
- data/lib/contrast/utils/log_utils.rb +47 -17
- data/lib/contrast/utils/net_http_base.rb +2 -2
- data/lib/contrast/utils/os.rb +0 -20
- data/lib/contrast/utils/patching/policy/patch_utils.rb +3 -2
- data/lib/contrast/utils/response_utils.rb +0 -16
- data/lib/contrast/utils/stack_trace_utils.rb +3 -40
- data/lib/contrast/utils/string_utils.rb +19 -7
- data/lib/contrast/utils/telemetry_client.rb +13 -7
- data/lib/contrast.rb +7 -13
- data/resources/protect/policy.json +1 -2
- data/ruby-agent.gemspec +2 -5
- metadata +78 -137
- data/exe/contrast_service +0 -23
- data/lib/contrast/agent/protect/rule/cmdi/cmdi_worth_watching.rb +0 -64
- data/lib/contrast/agent/protect/rule/sqli/sqli_worth_watching.rb +0 -118
- data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_matcher.rb +0 -45
- data/lib/contrast/agent/reaction_processor.rb +0 -47
- data/lib/contrast/agent/reporting/reporting_events/trace_event_source.rb +0 -30
- data/lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb +0 -43
- data/lib/contrast/agent/service_heartbeat.rb +0 -35
- data/lib/contrast/api/communication/messaging_queue.rb +0 -129
- data/lib/contrast/api/communication/response_processor.rb +0 -90
- data/lib/contrast/api/communication/service_lifecycle.rb +0 -77
- data/lib/contrast/api/communication/socket.rb +0 -44
- data/lib/contrast/api/communication/socket_client.rb +0 -130
- data/lib/contrast/api/communication/speedracer.rb +0 -142
- data/lib/contrast/api/communication/tcp_socket.rb +0 -32
- data/lib/contrast/api/communication/unix_socket.rb +0 -28
- data/lib/contrast/api/communication.rb +0 -20
- data/lib/contrast/api/decorators/activity.rb +0 -33
- data/lib/contrast/api/decorators/address.rb +0 -59
- data/lib/contrast/api/decorators/agent_startup.rb +0 -57
- data/lib/contrast/api/decorators/application_settings.rb +0 -42
- data/lib/contrast/api/decorators/application_startup.rb +0 -56
- data/lib/contrast/api/decorators/architecture_component.rb +0 -36
- data/lib/contrast/api/decorators/bot_blocker.rb +0 -37
- data/lib/contrast/api/decorators/finding.rb +0 -29
- data/lib/contrast/api/decorators/http_request.rb +0 -137
- data/lib/contrast/api/decorators/input_analysis.rb +0 -18
- data/lib/contrast/api/decorators/instrumentation_mode.rb +0 -35
- data/lib/contrast/api/decorators/ip_denylist.rb +0 -37
- data/lib/contrast/api/decorators/message.rb +0 -71
- data/lib/contrast/api/decorators/rasp_rule_sample.rb +0 -58
- data/lib/contrast/api/decorators/response_type.rb +0 -17
- data/lib/contrast/api/decorators/route_coverage.rb +0 -91
- data/lib/contrast/api/decorators/server_features.rb +0 -25
- data/lib/contrast/api/decorators/trace_event.rb +0 -120
- data/lib/contrast/api/decorators/trace_event_object.rb +0 -63
- data/lib/contrast/api/decorators/trace_event_signature.rb +0 -69
- data/lib/contrast/api/decorators/trace_taint_range.rb +0 -52
- data/lib/contrast/api/decorators/user_input.rb +0 -51
- data/lib/contrast/api/decorators/virtual_patch.rb +0 -34
- data/lib/contrast/api/decorators.rb +0 -28
- data/lib/contrast/api/dtm.pb.rb +0 -852
- data/lib/contrast/api/settings.pb.rb +0 -500
- data/lib/contrast/api.rb +0 -16
- data/lib/contrast/components/contrast_service.rb +0 -88
- data/lib/contrast/config/assess_configuration.rb +0 -93
- data/lib/contrast/config/assess_rules_configuration.rb +0 -32
- data/lib/contrast/config/root_configuration.rb +0 -90
- data/lib/contrast/config/ruby_configuration.rb +0 -81
- data/lib/contrast/config/service_configuration.rb +0 -49
- data/lib/contrast/tasks/service.rb +0 -84
- data/lib/contrast/utils/input_classification.rb +0 -73
- data/lib/contrast/utils/preflight_util.rb +0 -13
- data/lib/protobuf/code_generator.rb +0 -129
- data/lib/protobuf/decoder.rb +0 -28
- data/lib/protobuf/deprecation.rb +0 -117
- data/lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb +0 -79
- data/lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb +0 -360
- data/lib/protobuf/descriptors.rb +0 -3
- data/lib/protobuf/encoder.rb +0 -11
- data/lib/protobuf/enum.rb +0 -365
- data/lib/protobuf/exceptions.rb +0 -9
- data/lib/protobuf/field/base_field.rb +0 -380
- data/lib/protobuf/field/base_field_object_definitions.rb +0 -504
- data/lib/protobuf/field/bool_field.rb +0 -64
- data/lib/protobuf/field/bytes_field.rb +0 -67
- data/lib/protobuf/field/double_field.rb +0 -25
- data/lib/protobuf/field/enum_field.rb +0 -56
- data/lib/protobuf/field/field_array.rb +0 -102
- data/lib/protobuf/field/field_hash.rb +0 -122
- data/lib/protobuf/field/fixed32_field.rb +0 -25
- data/lib/protobuf/field/fixed64_field.rb +0 -28
- data/lib/protobuf/field/float_field.rb +0 -43
- data/lib/protobuf/field/int32_field.rb +0 -21
- data/lib/protobuf/field/int64_field.rb +0 -34
- data/lib/protobuf/field/integer_field.rb +0 -23
- data/lib/protobuf/field/message_field.rb +0 -51
- data/lib/protobuf/field/sfixed32_field.rb +0 -27
- data/lib/protobuf/field/sfixed64_field.rb +0 -28
- data/lib/protobuf/field/signed_integer_field.rb +0 -29
- data/lib/protobuf/field/sint32_field.rb +0 -21
- data/lib/protobuf/field/sint64_field.rb +0 -21
- data/lib/protobuf/field/string_field.rb +0 -51
- data/lib/protobuf/field/uint32_field.rb +0 -21
- data/lib/protobuf/field/uint64_field.rb +0 -21
- data/lib/protobuf/field/varint_field.rb +0 -77
- data/lib/protobuf/field.rb +0 -74
- data/lib/protobuf/generators/base.rb +0 -85
- data/lib/protobuf/generators/enum_generator.rb +0 -39
- data/lib/protobuf/generators/extension_generator.rb +0 -27
- data/lib/protobuf/generators/field_generator.rb +0 -193
- data/lib/protobuf/generators/file_generator.rb +0 -262
- data/lib/protobuf/generators/group_generator.rb +0 -122
- data/lib/protobuf/generators/message_generator.rb +0 -104
- data/lib/protobuf/generators/option_generator.rb +0 -17
- data/lib/protobuf/generators/printable.rb +0 -160
- data/lib/protobuf/generators/service_generator.rb +0 -50
- data/lib/protobuf/lifecycle.rb +0 -33
- data/lib/protobuf/logging.rb +0 -39
- data/lib/protobuf/message/fields.rb +0 -233
- data/lib/protobuf/message/serialization.rb +0 -85
- data/lib/protobuf/message.rb +0 -241
- data/lib/protobuf/optionable.rb +0 -72
- data/lib/protobuf/tasks/compile.rake +0 -80
- data/lib/protobuf/tasks.rb +0 -1
- data/lib/protobuf/varint.rb +0 -20
- data/lib/protobuf/varint_pure.rb +0 -31
- data/lib/protobuf/version.rb +0 -3
- data/lib/protobuf/wire_type.rb +0 -10
- data/lib/protobuf.rb +0 -91
- data/proto/dynamic_discovery.proto +0 -46
- data/proto/google/protobuf/compiler/plugin.proto +0 -183
- data/proto/google/protobuf/descriptor.proto +0 -911
- data/proto/rpc.proto +0 -71
- data/service_executables/.gitkeep +0 -0
- data/service_executables/VERSION +0 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
@@ -13,38 +13,20 @@ require 'contrast/agent/assess/rule/response/x_xss_protection_header_rule'
|
|
13
13
|
require 'contrast/agent/protect/input_analyzer/input_analyzer'
|
14
14
|
require 'contrast/components/logger'
|
15
15
|
require 'contrast/utils/log_utils'
|
16
|
+
require 'contrast/utils/string_utils'
|
16
17
|
|
17
18
|
module Contrast
|
18
19
|
module Agent
|
19
20
|
# This class extends RequestContexts: this class acts to encapsulate information about the currently
|
20
21
|
# executed request, making it available to the Agent for the duration of the request in a standardized
|
21
22
|
# and normalized format which the Agent understands.
|
22
|
-
module RequestContextExtend
|
23
|
+
module RequestContextExtend
|
23
24
|
include Contrast::Utils::CEFLogUtils
|
24
25
|
include Contrast::Components::Logger::InstanceMethods
|
25
|
-
BUILD_ATTACK_LOGGER_MESSAGE = 'Building attack result from Contrast Service input analysis result'
|
26
26
|
# Convert the discovered route for this request to appropriate forms and disseminate it to those locations
|
27
27
|
# where it is necessary for our route coverage and finding vulnerability discovery features to function.
|
28
28
|
#
|
29
|
-
# @param route [Contrast::
|
30
|
-
# framework
|
31
|
-
def append_route_coverage route
|
32
|
-
return unless route
|
33
|
-
|
34
|
-
# For our findings
|
35
|
-
@route = route
|
36
|
-
|
37
|
-
# For SR findings
|
38
|
-
@activity.routes << route
|
39
|
-
|
40
|
-
# For TS routes
|
41
|
-
@request.route = route
|
42
|
-
end
|
43
|
-
|
44
|
-
# Convert the discovered route for this request to appropriate forms and disseminate it to those locations
|
45
|
-
# where it is necessary for our route coverage and finding vulnerability discovery features to function.
|
46
|
-
#
|
47
|
-
# @param route [Contrast::Api::Dtm::RouteCoverage]
|
29
|
+
# @param route [Contrast::Agent::Reporting::RouteCoverage]
|
48
30
|
def append_to_observed_route route
|
49
31
|
return unless route
|
50
32
|
|
@@ -52,70 +34,30 @@ module Contrast
|
|
52
34
|
@observed_route.verb = route.verb
|
53
35
|
@observed_route.url = route.url if route.url
|
54
36
|
@request.observed_route = @observed_route
|
55
|
-
end
|
56
37
|
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
# @param response_type [Symbol] the result of the response, matching a value of
|
61
|
-
# Contrast::Api::Dtm::AttackResult::ResponseType
|
62
|
-
# @return [Array<Contrast::Api::Dtm::AttackResult>]
|
63
|
-
def results_for rule, response_type = nil
|
64
|
-
if response_type.nil?
|
65
|
-
activity.results.select { |r| r.rule_id == rule }
|
66
|
-
else
|
67
|
-
activity.results.select { |r| r.rule_id == rule && r.response == response_type }
|
68
|
-
end
|
38
|
+
observation = Contrast::Agent::Reporting::RouteDiscoveryObservation.new(route.url, route.verb)
|
39
|
+
@discovered_route = Contrast::Agent::Reporting::RouteDiscovery.new(route.route, observation)
|
40
|
+
@request.discovered_route = @discovered_route
|
69
41
|
end
|
70
42
|
|
43
|
+
# If protect is enabled for this request, examine said request for any possible attack input. If those inputs
|
44
|
+
# provided match a rule which should block at the perimeter, that will be raised here.
|
45
|
+
#
|
71
46
|
# @raise [Contrast::SecurityException]
|
72
|
-
def
|
47
|
+
def protect_input_analysis
|
73
48
|
return false unless ::Contrast::AGENT.enabled?
|
74
49
|
return false unless ::Contrast::PROTECT.enabled?
|
75
50
|
return false if @do_not_track
|
76
51
|
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
handle_protect_state(service_response)
|
81
|
-
ia = service_response.input_analysis
|
82
|
-
if ia
|
83
|
-
service_extract_logging(ia)
|
84
|
-
# TODO: RUBY-1629
|
85
|
-
# using Agent analysis
|
86
|
-
# initialize_agent_input_analysis request
|
87
|
-
|
88
|
-
@speedracer_input_analysis = ia
|
89
|
-
speedracer_input_analysis.request = request
|
52
|
+
if (ia = Contrast::Agent::Protect::InputAnalyzer.analyse(request))
|
53
|
+
@agent_input_analysis = ia
|
90
54
|
else
|
91
|
-
logger.trace('Analysis from
|
92
|
-
false
|
55
|
+
logger.trace('Analysis from Agent was empty.')
|
93
56
|
end
|
94
57
|
rescue Contrast::SecurityException => e
|
95
58
|
raise(e)
|
96
59
|
rescue StandardError => e
|
97
|
-
logger.warn('Unable to extract
|
98
|
-
false
|
99
|
-
end
|
100
|
-
|
101
|
-
# NOTE: this method is only used as a backstop if Speedracer sends Input Evaluations when the protect state
|
102
|
-
# indicates a security exception should be thrown. This method ensures that the attack reports are generated.
|
103
|
-
# Normally these should be generated on Speedracer for any attacks detected during prefilter.
|
104
|
-
#
|
105
|
-
# @param agent_settings [Contrast::Api::Settings::AgentSettings]
|
106
|
-
# @raise[Contrast::SecurityException]
|
107
|
-
def handle_protect_state agent_settings
|
108
|
-
return unless agent_settings&.protect_state
|
109
|
-
|
110
|
-
state = agent_settings.protect_state
|
111
|
-
@uuid = state.uuid
|
112
|
-
@do_not_track = true unless state.track_request
|
113
|
-
return unless state.security_exception
|
114
|
-
|
115
|
-
# If Contrast Service has NOT handled the input analysis, handle them here
|
116
|
-
build_attack_results(agent_settings)
|
117
|
-
logger.debug('Contrast Service said to block this request')
|
118
|
-
raise(Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior')))
|
60
|
+
logger.warn('Unable to extract protect information from request', e)
|
119
61
|
end
|
120
62
|
|
121
63
|
# append anything we've learned to the request seen message this is the sum-total of all inventory information
|
@@ -126,101 +68,18 @@ module Contrast
|
|
126
68
|
@response = Contrast::Agent::Response.new(rack_response)
|
127
69
|
return unless @sample_res
|
128
70
|
|
129
|
-
|
130
|
-
|
131
|
-
|
132
|
-
|
133
|
-
|
134
|
-
|
135
|
-
|
136
|
-
|
137
|
-
|
138
|
-
Contrast::Agent::Assess::Rule::Response::ParametersPollution.new.analyze(@response)
|
139
|
-
Contrast::Agent::Assess::Rule::Response::XContentType.new.analyze(@response)
|
140
|
-
Contrast::Agent::Assess::Rule::Response::XXssProtection.new.analyze(@response)
|
141
|
-
else
|
142
|
-
activity.http_response = @response.dtm
|
143
|
-
end
|
71
|
+
Contrast::Agent::Assess::Rule::Response::AutoComplete.new.analyze(@response)
|
72
|
+
Contrast::Agent::Assess::Rule::Response::CacheControl.new.analyze(@response)
|
73
|
+
Contrast::Agent::Assess::Rule::Response::ClickJacking.new.analyze(@response)
|
74
|
+
Contrast::Agent::Assess::Rule::Response::CspHeaderMissing.new.analyze(@response)
|
75
|
+
Contrast::Agent::Assess::Rule::Response::CspHeaderInsecure.new.analyze(@response)
|
76
|
+
Contrast::Agent::Assess::Rule::Response::HSTSHeader.new.analyze(@response)
|
77
|
+
Contrast::Agent::Assess::Rule::Response::ParametersPollution.new.analyze(@response)
|
78
|
+
Contrast::Agent::Assess::Rule::Response::XContentType.new.analyze(@response)
|
79
|
+
Contrast::Agent::Assess::Rule::Response::XXssProtection.new.analyze(@response)
|
144
80
|
rescue StandardError => e
|
145
81
|
logger.error('Unable to extract information after request', e)
|
146
82
|
end
|
147
|
-
|
148
|
-
# This here is for things we don't have implemented
|
149
|
-
def log_to_cef
|
150
|
-
activity.results.each { |attack_result| logging_logic(attack_result, attack_result.rule_id.downcase) }
|
151
|
-
end
|
152
|
-
|
153
|
-
# @param input_analysis [Contrast::Api::Settings::InputAnalysis]
|
154
|
-
def service_extract_logging input_analysis
|
155
|
-
log_to_cef
|
156
|
-
logger.trace('Analysis from Contrast Service', evaluations: input_analysis.results.length) if logger.trace?
|
157
|
-
logger.trace('Results', input_analysis: input_analysis.inspect) if logger.trace?
|
158
|
-
end
|
159
|
-
|
160
|
-
private
|
161
|
-
|
162
|
-
# Generate attack results directly from any evaluations on the agent settings object.
|
163
|
-
#
|
164
|
-
# @param agent_settings [Contrast::Api::Settings::AgentSettings]
|
165
|
-
def build_attack_results agent_settings
|
166
|
-
return unless agent_settings&.input_analysis&.results&.any?
|
167
|
-
|
168
|
-
results_by_rule = {}
|
169
|
-
agent_settings.input_analysis.results.each do |ia_result|
|
170
|
-
rule_id = ia_result.rule_id
|
171
|
-
rule = ::Contrast::PROTECT.rule(rule_id)
|
172
|
-
next unless rule
|
173
|
-
|
174
|
-
logger.debug(BUILD_ATTACK_LOGGER_MESSAGE, result: ia_result.inspect) if logger.debug?
|
175
|
-
results_by_rule[rule_id] = attack_result(rule, rule_id, ia_result, results_by_rule)
|
176
|
-
end
|
177
|
-
|
178
|
-
results_by_rule.each_pair do |_, attack_result|
|
179
|
-
logger.info('Blocking attack result', rule: attack_result.rule_id)
|
180
|
-
activity.results << attack_result
|
181
|
-
end
|
182
|
-
end
|
183
|
-
|
184
|
-
# Generates the attack result
|
185
|
-
#
|
186
|
-
# @param rule [Contrast::Agent::Protect::Rule, Contrast::Agent::Assess::Rule]
|
187
|
-
# @param rule_id [String] String name of the rule
|
188
|
-
# @param ia_result [Contrast::Api::Settings::InputAnalysisResult] the
|
189
|
-
# analysis of the input that was determined to be an attack
|
190
|
-
# @param results_by_rule [Hash] attack results from any evaluations on the agent settings object.
|
191
|
-
# @return [Contrast::Api::Dtm::AttackResult] the attack result from this input
|
192
|
-
def attack_result rule, rule_id, ia_result, results_by_rule
|
193
|
-
@_attack_result = if rule.mode == :BLOCK
|
194
|
-
# special case for rules (like reflected xss) that used to have an infilter / block mode
|
195
|
-
# but now are just block at perimeter
|
196
|
-
rule.build_attack_with_match(self, ia_result, results_by_rule[rule_id], ia_result.value)
|
197
|
-
else
|
198
|
-
rule.build_attack_without_match(self, ia_result, results_by_rule[rule_id])
|
199
|
-
end
|
200
|
-
end
|
201
|
-
|
202
|
-
def logging_logic result, rule_id
|
203
|
-
rules = %w[bot_blocker virtual_patch ip_denylist]
|
204
|
-
return unless rules.include?(rule_id)
|
205
|
-
|
206
|
-
rule_details = Contrast::Api::Dtm::RaspRuleSample.to_controlled_hash(result.samples[0]).fetch(rule_id.to_sym)
|
207
|
-
outcome = Contrast::Api::Dtm::AttackResult::ResponseType.get_name_by_tag(result.response)
|
208
|
-
case rule_id
|
209
|
-
when /bot_blocker/i
|
210
|
-
blocker_to_json = Contrast::Api::Dtm::BotBlockerDetails.to_controlled_hash(rule_details)
|
211
|
-
cef_logger.bot_blocking_message(blocker_to_json, outcome)
|
212
|
-
when /virtual_patch/i
|
213
|
-
virtual_patch_to_json = Contrast::Api::Dtm::VirtualPatchDetails.to_controlled_hash(rule_details)
|
214
|
-
cef_logger.virtual_patch_message(virtual_patch_to_json, outcome)
|
215
|
-
when /ip_denylist/i
|
216
|
-
sender_ip = extract_sender_ip
|
217
|
-
ip_denylist_to_json = Contrast::Api::Dtm::IpDenylistDetails.to_controlled_hash(rule_details)
|
218
|
-
return unless sender_ip
|
219
|
-
return unless sender_ip.include?(ip_denylist_to_json[:ip])
|
220
|
-
|
221
|
-
cef_logger.ip_denylisted_message(sender_ip, ip_denylist_to_json, outcome)
|
222
|
-
end
|
223
|
-
end
|
224
83
|
end
|
225
84
|
end
|
226
85
|
end
|
@@ -4,7 +4,6 @@
|
|
4
4
|
require 'contrast/components/logger'
|
5
5
|
require 'contrast/components/scope'
|
6
6
|
require 'contrast/agent/reporting/reporter'
|
7
|
-
require 'contrast/agent/reporting/reporting_utilities/dtm_message'
|
8
7
|
require 'contrast/agent/reporting/masker/masker'
|
9
8
|
|
10
9
|
module Contrast
|
@@ -22,13 +21,6 @@ module Contrast
|
|
22
21
|
@ruleset = ::Contrast::AGENT.ruleset
|
23
22
|
end
|
24
23
|
|
25
|
-
# Send Activities messages to TS [Contrast::Api::Dtm::Activity]
|
26
|
-
# TODO: RUBY-1704
|
27
|
-
# TODO: RUBY-1438
|
28
|
-
def send_activity_messages
|
29
|
-
Contrast::Agent.messaging_queue&.send_event_eventually(context.activity)
|
30
|
-
end
|
31
|
-
|
32
24
|
# reports events[Contrast::Agent::Reporting::ReporterEvent] to TS
|
33
25
|
# This method is used to send our JSON messages directly to TeamServer at the end of each request. As we move
|
34
26
|
# more endpoints over, this method will take the messages originally sent by #send_actiivty_messages. At the end,
|
@@ -37,11 +29,9 @@ module Contrast
|
|
37
29
|
return unless (reporter = Contrast::Agent.reporter)
|
38
30
|
|
39
31
|
reporter.send_event(context.observed_route)
|
40
|
-
return unless Contrast::Agent::Reporter.enabled?
|
41
|
-
|
42
32
|
# Mask Sensitive Data
|
43
33
|
Contrast::Agent::Reporting::Masker.mask(context.activity)
|
44
|
-
event =
|
34
|
+
event = context.activity
|
45
35
|
reporter.send_event(event)
|
46
36
|
end
|
47
37
|
|
@@ -45,24 +45,6 @@ module Contrast
|
|
45
45
|
end
|
46
46
|
end
|
47
47
|
|
48
|
-
# A form of the Rack::Response which we can report to the Service to be sent to TeamServer for processing. B/c
|
49
|
-
# the response can change, we can't memoize this :(
|
50
|
-
#
|
51
|
-
# @return [Contrast::Api::Dtm::HttpResponse]
|
52
|
-
def dtm
|
53
|
-
context_response = Contrast::Api::Dtm::HttpResponse.new
|
54
|
-
context_response.response_code = response_code.to_i
|
55
|
-
headers&.each_pair do |key, value|
|
56
|
-
append_pair(context_response.normalized_response_headers, key, value)
|
57
|
-
end
|
58
|
-
context_response.response_body_binary = Contrast::Utils::StringUtils.force_utf8(body)
|
59
|
-
|
60
|
-
doc_type = document_type
|
61
|
-
context_response.document_type = doc_type if doc_type
|
62
|
-
|
63
|
-
context_response
|
64
|
-
end
|
65
|
-
|
66
48
|
# The response code of this response
|
67
49
|
#
|
68
50
|
# @return [Integer]
|
@@ -50,7 +50,7 @@ module Contrast
|
|
50
50
|
def initialize
|
51
51
|
super
|
52
52
|
@settings = []
|
53
|
-
add_config_keys(::Contrast::CONFIG.
|
53
|
+
add_config_keys(::Contrast::CONFIG.config, 'root')
|
54
54
|
@settings << ENV.keys.select { |v| v.starts_with?('CONTRAST') }
|
55
55
|
@settings.flatten
|
56
56
|
add_tags
|
@@ -70,9 +70,9 @@ module Contrast
|
|
70
70
|
end
|
71
71
|
|
72
72
|
def add_config_keys config, nested_key
|
73
|
-
config.
|
73
|
+
config.to_contrast_hash.reject! { |_k, v| REJECTED_VALUES.include?(v) }
|
74
74
|
|
75
|
-
config.
|
75
|
+
config.to_contrast_hash.each do |k, v|
|
76
76
|
unless v.cs__class <= Contrast::Config::BaseConfiguration
|
77
77
|
@settings << "#{ nested_key }.#{ k }"
|
78
78
|
next
|
@@ -2,8 +2,6 @@
|
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
4
|
require 'contrast/components/logger'
|
5
|
-
require 'contrast/agent/service_heartbeat'
|
6
|
-
require 'contrast/api/communication/messaging_queue'
|
7
5
|
require 'contrast/agent/reporting/report'
|
8
6
|
require 'contrast/agent/reporting/reporter_heartbeat'
|
9
7
|
require 'contrast/agent/telemetry/base'
|
@@ -16,10 +14,6 @@ module Contrast
|
|
16
14
|
|
17
15
|
# @return [Contrast::Utils::HeapDumpUtil]
|
18
16
|
attr_reader :heapdump_util
|
19
|
-
# @return [Contrast::Agent::ServiceHeartbeat, nil]
|
20
|
-
attr_reader :heartbeat
|
21
|
-
# @return [Contrast::Api::Communication::MessagingQueue, nil]
|
22
|
-
attr_reader :messaging_queue
|
23
17
|
# @return [Contrast::Agent::Reporter]
|
24
18
|
attr_reader :reporter
|
25
19
|
# @return [Contrast::Agent::ReporterHeartbeat]
|
@@ -28,10 +22,6 @@ module Contrast
|
|
28
22
|
def initialize
|
29
23
|
@pids = {}
|
30
24
|
@heapdump_util = Contrast::Utils::HeapDumpUtil.new
|
31
|
-
unless ::Contrast::CONTRAST_SERVICE.unnecessary?
|
32
|
-
@heartbeat = Contrast::Agent::ServiceHeartbeat.new
|
33
|
-
@messaging_queue = Contrast::Api::Communication::MessagingQueue.new
|
34
|
-
end
|
35
25
|
@reporter = Contrast::Agent::Reporter.new
|
36
26
|
@reporter_heartbeat = Contrast::Agent::ReporterHeartbeat.new
|
37
27
|
@telemetry = Contrast::Agent::Telemetry::Base.new if Contrast::Agent::Telemetry::Base.enabled?
|
@@ -42,16 +32,13 @@ module Contrast
|
|
42
32
|
return unless ::Contrast::AGENT.enabled?
|
43
33
|
|
44
34
|
logger.debug('ThreadWatcher started threads')
|
45
|
-
|
46
|
-
|
47
|
-
@pids[Process.pid] =
|
35
|
+
reporter_status = init_thread(reporter)
|
36
|
+
reporter_heartbeat_status = init_thread(reporter_heartbeat)
|
37
|
+
@pids[Process.pid] = reporter_status && reporter_heartbeat_status
|
48
38
|
if Contrast::Agent::Telemetry::Base.enabled?
|
49
39
|
telemetry_status = init_thread(telemetry_queue)
|
50
40
|
@pids[Process.pid] = @pids[Process.pid] && telemetry_status
|
51
41
|
end
|
52
|
-
reporter_status = init_thread(reporter)
|
53
|
-
reporter_heartbeat_status = init_thread(reporter_heartbeat)
|
54
|
-
@pids[Process.pid] = @pids[Process.pid] && reporter_status && reporter_heartbeat_status
|
55
42
|
@pids
|
56
43
|
end
|
57
44
|
|
@@ -63,8 +50,6 @@ module Contrast
|
|
63
50
|
end
|
64
51
|
|
65
52
|
def shutdown!
|
66
|
-
heartbeat&.stop!
|
67
|
-
messaging_queue&.stop!
|
68
53
|
heapdump_util&.stop!
|
69
54
|
telemetry_queue&.stop!
|
70
55
|
reporter&.stop!
|
data/lib/contrast/agent.rb
CHANGED
@@ -42,9 +42,6 @@ require 'contrast/utils/thread_tracker'
|
|
42
42
|
# Framework support
|
43
43
|
require 'contrast/framework/manager'
|
44
44
|
|
45
|
-
# Communication to SR
|
46
|
-
require 'contrast/api/communication'
|
47
|
-
|
48
45
|
require 'contrast/agent/thread_watcher'
|
49
46
|
|
50
47
|
module Contrast
|
@@ -66,11 +63,6 @@ module Contrast
|
|
66
63
|
thread_watcher.heapdump_util
|
67
64
|
end
|
68
65
|
|
69
|
-
# @return [nil, Contrast::Api::Communication::MessagingQueue]
|
70
|
-
def self.messaging_queue
|
71
|
-
thread_watcher.messaging_queue
|
72
|
-
end
|
73
|
-
|
74
66
|
# @return [nil, Contrast::Agent::Telemetry::Base]
|
75
67
|
def self.telemetry_queue
|
76
68
|
thread_watcher.telemetry_queue
|
@@ -87,14 +79,11 @@ module Contrast
|
|
87
79
|
end
|
88
80
|
end
|
89
81
|
|
90
|
-
require 'contrast/api'
|
91
|
-
|
92
82
|
require 'contrast/utils/resource_loader'
|
93
83
|
require 'contrast/utils/duck_utils'
|
94
84
|
require 'contrast/agent/tracepoint_hook'
|
95
85
|
require 'contrast/agent/at_exit_hook'
|
96
86
|
|
97
|
-
# communication with contrast service
|
98
87
|
require 'contrast/agent/exclusion_matcher'
|
99
88
|
|
100
89
|
# threads that handle contrast scope
|
@@ -0,0 +1,46 @@
|
|
1
|
+
# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: false
|
3
|
+
|
4
|
+
require 'ffi'
|
5
|
+
# require the gem
|
6
|
+
require 'contrast-agent-lib'
|
7
|
+
|
8
|
+
module Contrast
|
9
|
+
module AgentLib
|
10
|
+
# This module is defined in Rust as external, we used it here.
|
11
|
+
# Initializes the AgentLib. Here will be all methods from
|
12
|
+
# the C bindings contrast_c::cmdi_semantic_chained_command module.
|
13
|
+
module CommandInjection
|
14
|
+
extend FFI::Library
|
15
|
+
ffi_lib ContrastAgentLib::CONTRAST_C
|
16
|
+
|
17
|
+
attach_function :get_index_of_chained_command, [:string], :long_long
|
18
|
+
attach_function :does_command_contain_dangerous_path, [:string], :int
|
19
|
+
|
20
|
+
private
|
21
|
+
|
22
|
+
# Checks that a given shell command contained a chained command.
|
23
|
+
# This is used for the cmd-injection-semantic-chained-commands rule.
|
24
|
+
#
|
25
|
+
# @param cmd [String] command to check.
|
26
|
+
# @return index[Integer] Returns the index of the command chaining if found.
|
27
|
+
# If the chaining index is >= 0, an injection is detected. Returns -1 when
|
28
|
+
# no command chaining is found.
|
29
|
+
def dl__index_of_chained_command cmd
|
30
|
+
get_index_of_chained_command(cmd)
|
31
|
+
end
|
32
|
+
|
33
|
+
# Checks if a given shell command is trying to access a dangerous path.
|
34
|
+
# This is used for the cmd-injection-semantic-dangerous-paths rule.
|
35
|
+
#
|
36
|
+
# @param path [String] path to check.
|
37
|
+
# @return index[Boolean] Returns 1 if a dangerous path is found.
|
38
|
+
# Returns 0 if no dangerous paths are found.
|
39
|
+
def dl__dangerous_path? path
|
40
|
+
return false if does_command_contain_dangerous_path(path).zero?
|
41
|
+
|
42
|
+
true
|
43
|
+
end
|
44
|
+
end
|
45
|
+
end
|
46
|
+
end
|
@@ -0,0 +1,101 @@
|
|
1
|
+
# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: false
|
3
|
+
|
4
|
+
require 'ffi'
|
5
|
+
# require the gem
|
6
|
+
require 'contrast-agent-lib'
|
7
|
+
|
8
|
+
module Contrast
|
9
|
+
module AgentLib
|
10
|
+
# This module is defined in Rust as external, we used it here.
|
11
|
+
# Initializes the AgentLib. Here will be all methods from
|
12
|
+
# the C bindings agent_init mod.
|
13
|
+
module Init
|
14
|
+
extend FFI::Library
|
15
|
+
ffi_lib ContrastAgentLib::CONTRAST_C
|
16
|
+
|
17
|
+
# Init
|
18
|
+
#
|
19
|
+
# 0 => OK, -1 => Err
|
20
|
+
# The attach function could be called also like this:
|
21
|
+
# attach_function :ruby_name, :c_name, [ :params ], :returns, { :options => values }
|
22
|
+
# an that way we define a ruby_name for the C method, but we alias to make a documentation
|
23
|
+
# for the method.
|
24
|
+
#
|
25
|
+
# Also we extend the FFI::Library inside this module so we could also redefine the
|
26
|
+
# attach_function to our taste, not worry about it leaking outside of this module.
|
27
|
+
#
|
28
|
+
# @param [Symbol] Name of required function.
|
29
|
+
# @param [Array] An array of argument types.
|
30
|
+
# @return [Integer] Return type of the function.
|
31
|
+
attach_function :init, [], :int
|
32
|
+
|
33
|
+
# TODO: RUBY-1693
|
34
|
+
# Initialize agent lib without any optional settings. To set optional settings consider using
|
35
|
+
# `init_with_options` instead If you want to enable logging, it must be set using environment variables
|
36
|
+
# `CONTRAST_AGENTLIB_LOG_LEVEL` - set to log level. Must of one of ERROR, WARN, INFO, DEBUG or TRACE
|
37
|
+
# `CONTRAST_AGENTLIB_LOG_DIR` - must point to an accessible directory where logs will be written.
|
38
|
+
# The name of the log file
|
39
|
+
# is auto-generated and cannot be set. The format is 'libcontrast_<date>_<process_id>.log'
|
40
|
+
#
|
41
|
+
# If these environment variables are not present during `init`, agent-lib will be initialized with
|
42
|
+
# logging disabled and you will not be able to re-enable it using `change_log_settings`
|
43
|
+
# @param [Symbol] Name of required function.
|
44
|
+
# @param [Array] An array of argument types.
|
45
|
+
# @return [Integer] Return type of the function.
|
46
|
+
attach_function :init_with_options, %i[bool string string], :int
|
47
|
+
|
48
|
+
# TODO: RUBY-1693
|
49
|
+
# Change log settings for agent lib after it's been initialized. This api must be used after init
|
50
|
+
#
|
51
|
+
# Safety
|
52
|
+
# The `log_level` parameter must point to must point to an UTF-8 encoded string C-string
|
53
|
+
# @param enable_logging [Boolean] flag to enable or disable logging.
|
54
|
+
# @param log_level [String] UTF-8 encoded string indicating the maximum log level
|
55
|
+
# if logging is enabled
|
56
|
+
attach_function :change_log_settings, %i[bool string], :int
|
57
|
+
|
58
|
+
# TODO: RUBY-1693
|
59
|
+
# Initialize AgentLib with options.
|
60
|
+
# If init returns 0 = successful setup with options
|
61
|
+
# if init returns 1 = unsuccessful setup with options
|
62
|
+
#
|
63
|
+
# @param enable_logging [Boolean] flag to enable or disable logging.
|
64
|
+
# @param log_dir [String] path to existing log directory.
|
65
|
+
# @param log_level [String] OFF, ERROR, WARN, INFO, DEBUG or TRACE.
|
66
|
+
# @return [Boolean] true if initialized false if not.
|
67
|
+
def dl__init_with_options enable_logging, log_dir, log_level
|
68
|
+
# This is useful for scope sensitive string pointers, if function ends and
|
69
|
+
# you need them to be picked up after the C function.
|
70
|
+
init_with_options(enable_logging, log_dir, log_level).zero?
|
71
|
+
end
|
72
|
+
|
73
|
+
private
|
74
|
+
|
75
|
+
# Initialize AgentLib without options. Log level could not be set after.
|
76
|
+
# If you want to set the log levels you can do it be ENV variables:
|
77
|
+
# EVN [CONTRAST_AGENTLIB_LOG_LEVEL] - set to log level. Must of one of ERROR, WARN, INFO, DEBUG or TRACE
|
78
|
+
# ENV['CONTRAST_AGENTLIB_LOG_DIR'] - must point to an accessible directory where logs will be written.
|
79
|
+
# The name of the log file.
|
80
|
+
#
|
81
|
+
# @return [Boolean] true if initialized, false if not.
|
82
|
+
def dl__init
|
83
|
+
init.zero?
|
84
|
+
end
|
85
|
+
|
86
|
+
# TODO: RUBY-1693
|
87
|
+
# Change the log settings. This api must be called after the dl__init_with_options.
|
88
|
+
#
|
89
|
+
# @param enable_log [Boolean] flag to enable or disable logging this sets the inner flag.
|
90
|
+
# @param log_level [String] OFF, ERROR, WARN, INFO, DEBUG or TRACE.
|
91
|
+
# @return [Boolean] true if initialized false if not.
|
92
|
+
def dl__change_log_settings enable_log, log_level
|
93
|
+
# transform to C strings pointers here and pass to function.
|
94
|
+
log_dir_pointer = FFI::MemoryPointer.from_string(log_level.dup.force_encoding('UTF-8'))
|
95
|
+
return true if change_log_settings(enable_log, log_dir_pointer).zero?
|
96
|
+
|
97
|
+
false
|
98
|
+
end
|
99
|
+
end
|
100
|
+
end
|
101
|
+
end
|