contrast-agent 6.6.4 → 6.8.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 6.6.4
+  version: 6.8.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-07-20 00:00:00.000000000 Z
+date: 2022-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -644,43 +644,56 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: activesupport
+  name: contrast-agent-lib
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: 0.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 description: This gem instantiates a Rack middleware for rack-based web applications
   in order to provide Interactive Application Security Testing and Protection.
 email:
 - ruby@contrastsecurity.com
-executables:
-- contrast_service
+executables: []
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__tests/extconf.rb
-- ext/cs__assess_module/extconf.rb
-- ext/cs__assess_array/extconf.rb
 - ext/cs__assess_hash/extconf.rb
 - ext/cs__assess_basic_object/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
-- ext/cs__os_information/extconf.rb
-- ext/cs__assess_test/extconf.rb
 - ext/cs__assess_string/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__assess_string_interpolation/extconf.rb
 - ext/cs__scope/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
+- ext/cs__assess_module/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_test/extconf.rb
+- ext/cs__os_information/extconf.rb
+- ext/cs__assess_array/extconf.rb
+- ext/cs__tests/extconf.rb
 - ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -694,7 +707,6 @@ files:
 - Gemfile
 - LICENSE.txt
 - Rakefile
-- exe/contrast_service
 - ext/build_funchook.rb
 - ext/cs__assess_array/cs__assess_array.c
 - ext/cs__assess_array/cs__assess_array.h
@@ -960,6 +972,7 @@ files:
 - lib/contrast/agent/deadzone/policy/deadzone_node.rb
 - lib/contrast/agent/deadzone/policy/policy.rb
 - lib/contrast/agent/disable_reaction.rb
+- lib/contrast/agent/excluder.rb
 - lib/contrast/agent/exclusion_matcher.rb
 - lib/contrast/agent/inventory.rb
 - lib/contrast/agent/inventory/database_config.rb
@@ -996,9 +1009,14 @@ files:
 - lib/contrast/agent/protect/rule.rb
 - lib/contrast/agent/protect/rule/base.rb
 - lib/contrast/agent/protect/rule/base_service.rb
+- lib/contrast/agent/protect/rule/bot_blocker.rb
+- lib/contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification.rb
 - lib/contrast/agent/protect/rule/cmd_injection.rb
+- lib/contrast/agent/protect/rule/cmdi/cmdi_backdoors.rb
+- lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb
+- lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb
+- lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb
 - lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb
-- lib/contrast/agent/protect/rule/cmdi/cmdi_worth_watching.rb
 - lib/contrast/agent/protect/rule/default_scanner.rb
 - lib/contrast/agent/protect/rule/deserialization.rb
 - lib/contrast/agent/protect/rule/http_method_tampering.rb
@@ -1007,25 +1025,47 @@ files:
 - lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb
 - lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb
 - lib/contrast/agent/protect/rule/path_traversal.rb
+- lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb
+- lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb
 - lib/contrast/agent/protect/rule/sql_sample_builder.rb
 - lib/contrast/agent/protect/rule/sqli.rb
 - lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb
 - lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb
 - lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb
+- lib/contrast/agent/protect/rule/sqli/sqli_base_rule.rb
 - lib/contrast/agent/protect/rule/sqli/sqli_input_classification.rb
-- lib/contrast/agent/protect/rule/sqli/sqli_worth_watching.rb
+- lib/contrast/agent/protect/rule/sqli/sqli_semantic/sqli_dangerous_functions.rb
 - lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb
 - lib/contrast/agent/protect/rule/unsafe_file_upload.rb
 - lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification.rb
-- lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_matcher.rb
 - lib/contrast/agent/protect/rule/xss.rb
+- lib/contrast/agent/protect/rule/xss/reflected_xss_input_classification.rb
 - lib/contrast/agent/protect/rule/xxe.rb
 - lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb
-- lib/contrast/agent/reaction_processor.rb
 - lib/contrast/agent/reporting/attack_result/attack_result.rb
 - lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb
 - lib/contrast/agent/reporting/attack_result/response_type.rb
 - lib/contrast/agent/reporting/attack_result/user_input.rb
+- lib/contrast/agent/reporting/details/bot_blocker_details.rb
+- lib/contrast/agent/reporting/details/cmd_injection_details.rb
+- lib/contrast/agent/reporting/details/details.rb
+- lib/contrast/agent/reporting/details/http_method_tempering_details.rb
+- lib/contrast/agent/reporting/details/ip_denylist_details.rb
+- lib/contrast/agent/reporting/details/no_sqli_details.rb
+- lib/contrast/agent/reporting/details/path_traversal_details.rb
+- lib/contrast/agent/reporting/details/path_traversal_semantic_analysis_details.rb
+- lib/contrast/agent/reporting/details/protect_rule_details.rb
+- lib/contrast/agent/reporting/details/sqli_dangerous_functions.rb
+- lib/contrast/agent/reporting/details/sqli_details.rb
+- lib/contrast/agent/reporting/details/untrusted_deserialization_details.rb
+- lib/contrast/agent/reporting/details/virtual_patch_details.rb
+- lib/contrast/agent/reporting/details/xss_details.rb
+- lib/contrast/agent/reporting/details/xss_match.rb
+- lib/contrast/agent/reporting/details/xxe_details.rb
+- lib/contrast/agent/reporting/details/xxe_match.rb
+- lib/contrast/agent/reporting/details/xxe_wrapper.rb
+- lib/contrast/agent/reporting/input_analysis/details/bot_blocker_details.rb
+- lib/contrast/agent/reporting/input_analysis/details/protect_rule_details.rb
 - lib/contrast/agent/reporting/input_analysis/input_analysis.rb
 - lib/contrast/agent/reporting/input_analysis/input_analysis_result.rb
 - lib/contrast/agent/reporting/input_analysis/input_type.rb
@@ -1060,6 +1100,7 @@ files:
 - lib/contrast/agent/reporting/reporting_events/finding_event_source.rb
 - lib/contrast/agent/reporting/reporting_events/finding_event_stack.rb
 - lib/contrast/agent/reporting/reporting_events/finding_event_taint_range.rb
+- lib/contrast/agent/reporting/reporting_events/finding_event_taint_range_tags.rb
 - lib/contrast/agent/reporting/reporting_events/finding_request.rb
 - lib/contrast/agent/reporting/reporting_events/library_discovery.rb
 - lib/contrast/agent/reporting/reporting_events/library_usage_observation.rb
@@ -1074,10 +1115,8 @@ files:
 - lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb
 - lib/contrast/agent/reporting/reporting_events/server_activity.rb
 - lib/contrast/agent/reporting/reporting_events/server_reporting_event.rb
-- lib/contrast/agent/reporting/reporting_events/trace_event_source.rb
 - lib/contrast/agent/reporting/reporting_utilities/audit.rb
 - lib/contrast/agent/reporting/reporting_utilities/build_preflight.rb
-- lib/contrast/agent/reporting/reporting_utilities/dtm_message.rb
 - lib/contrast/agent/reporting/reporting_utilities/endpoints.rb
 - lib/contrast/agent/reporting/reporting_utilities/headers.rb
 - lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb
@@ -1119,7 +1158,6 @@ files:
 - lib/contrast/agent/response.rb
 - lib/contrast/agent/rule_set.rb
 - lib/contrast/agent/scope.rb
-- lib/contrast/agent/service_heartbeat.rb
 - lib/contrast/agent/static_analysis.rb
 - lib/contrast/agent/telemetry/base.rb
 - lib/contrast/agent/telemetry/events/event.rb
@@ -1137,64 +1175,37 @@ files:
 - lib/contrast/agent/tracepoint_hook.rb
 - lib/contrast/agent/version.rb
 - lib/contrast/agent/worker_thread.rb
-- lib/contrast/api.rb
+- lib/contrast/agent_lib/api/command_injection.rb
+- lib/contrast/agent_lib/api/init.rb
+- lib/contrast/agent_lib/api/input_tracing.rb
+- lib/contrast/agent_lib/api/method_tempering.rb
+- lib/contrast/agent_lib/api/panic.rb
+- lib/contrast/agent_lib/api/path_semantic_file_security_bypass.rb
+- lib/contrast/agent_lib/interface.rb
+- lib/contrast/agent_lib/interface_base.rb
+- lib/contrast/agent_lib/return_types/eval_result.rb
+- lib/contrast/agent_lib/test.rb
 - lib/contrast/api/.gitkeep
-- lib/contrast/api/communication.rb
 - lib/contrast/api/communication/connection_status.rb
-- lib/contrast/api/communication/messaging_queue.rb
-- lib/contrast/api/communication/response_processor.rb
-- lib/contrast/api/communication/service_lifecycle.rb
-- lib/contrast/api/communication/socket.rb
-- lib/contrast/api/communication/socket_client.rb
-- lib/contrast/api/communication/speedracer.rb
-- lib/contrast/api/communication/tcp_socket.rb
-- lib/contrast/api/communication/unix_socket.rb
-- lib/contrast/api/decorators.rb
-- lib/contrast/api/decorators/activity.rb
-- lib/contrast/api/decorators/address.rb
-- lib/contrast/api/decorators/agent_startup.rb
-- lib/contrast/api/decorators/application_settings.rb
-- lib/contrast/api/decorators/application_startup.rb
-- lib/contrast/api/decorators/architecture_component.rb
-- lib/contrast/api/decorators/bot_blocker.rb
-- lib/contrast/api/decorators/finding.rb
-- lib/contrast/api/decorators/http_request.rb
-- lib/contrast/api/decorators/input_analysis.rb
-- lib/contrast/api/decorators/instrumentation_mode.rb
-- lib/contrast/api/decorators/ip_denylist.rb
-- lib/contrast/api/decorators/message.rb
-- lib/contrast/api/decorators/rasp_rule_sample.rb
-- lib/contrast/api/decorators/response_type.rb
-- lib/contrast/api/decorators/route_coverage.rb
-- lib/contrast/api/decorators/server_features.rb
-- lib/contrast/api/decorators/trace_event.rb
-- lib/contrast/api/decorators/trace_event_object.rb
-- lib/contrast/api/decorators/trace_event_signature.rb
-- lib/contrast/api/decorators/trace_taint_range.rb
-- lib/contrast/api/decorators/trace_taint_range_tags.rb
-- lib/contrast/api/decorators/user_input.rb
-- lib/contrast/api/decorators/virtual_patch.rb
-- lib/contrast/api/dtm.pb.rb
-- lib/contrast/api/settings.pb.rb
 - lib/contrast/components/agent.rb
 - lib/contrast/components/api.rb
 - lib/contrast/components/app_context.rb
 - lib/contrast/components/app_context_extend.rb
 - lib/contrast/components/assess.rb
+- lib/contrast/components/assess_rules.rb
 - lib/contrast/components/base.rb
 - lib/contrast/components/config.rb
-- lib/contrast/components/contrast_service.rb
 - lib/contrast/components/heap_dump.rb
 - lib/contrast/components/inventory.rb
 - lib/contrast/components/logger.rb
 - lib/contrast/components/protect.rb
+- lib/contrast/components/ruby_component.rb
 - lib/contrast/components/sampling.rb
 - lib/contrast/components/scope.rb
+- lib/contrast/components/security_logger.rb
 - lib/contrast/components/settings.rb
 - lib/contrast/config.rb
 - lib/contrast/config/api_proxy_configuration.rb
-- lib/contrast/config/assess_configuration.rb
-- lib/contrast/config/assess_rules_configuration.rb
 - lib/contrast/config/base_configuration.rb
 - lib/contrast/config/certification_configuration.rb
 - lib/contrast/config/env_variables.rb
@@ -1202,10 +1213,7 @@ files:
 - lib/contrast/config/protect_rule_configuration.rb
 - lib/contrast/config/protect_rules_configuration.rb
 - lib/contrast/config/request_audit_configuration.rb
-- lib/contrast/config/root_configuration.rb
-- lib/contrast/config/ruby_configuration.rb
 - lib/contrast/config/server_configuration.rb
-- lib/contrast/config/service_configuration.rb
 - lib/contrast/configuration.rb
 - lib/contrast/extension/assess.rb
 - lib/contrast/extension/assess/array.rb
@@ -1250,7 +1258,6 @@ files:
 - lib/contrast/logger/time.rb
 - lib/contrast/security_exception.rb
 - lib/contrast/tasks/config.rb
-- lib/contrast/tasks/service.rb
 - lib/contrast/utils/assess/event_limit_utils.rb
 - lib/contrast/utils/assess/object_store.rb
 - lib/contrast/utils/assess/propagation_method_utils.rb
@@ -1268,7 +1275,7 @@ files:
 - lib/contrast/utils/hash_digest_extend.rb
 - lib/contrast/utils/head_dump_utils_extend.rb
 - lib/contrast/utils/heap_dump_util.rb
-- lib/contrast/utils/input_classification.rb
+- lib/contrast/utils/input_classification_base.rb
 - lib/contrast/utils/invalid_configuration_util.rb
 - lib/contrast/utils/io_util.rb
 - lib/contrast/utils/job_servers_running.rb
@@ -1281,7 +1288,6 @@ files:
 - lib/contrast/utils/os.rb
 - lib/contrast/utils/patching/policy/patch_utils.rb
 - lib/contrast/utils/patching/policy/patcher_utils.rb
-- lib/contrast/utils/preflight_util.rb
 - lib/contrast/utils/request_utils.rb
 - lib/contrast/utils/resource_loader.rb
 - lib/contrast/utils/response_utils.rb
@@ -1295,77 +1301,12 @@ files:
 - lib/contrast/utils/telemetry_identifier.rb
 - lib/contrast/utils/thread_tracker.rb
 - lib/contrast/utils/timer.rb
-- lib/protobuf.rb
-- lib/protobuf/code_generator.rb
-- lib/protobuf/decoder.rb
-- lib/protobuf/deprecation.rb
-- lib/protobuf/descriptors.rb
-- lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb
-- lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb
-- lib/protobuf/encoder.rb
-- lib/protobuf/enum.rb
-- lib/protobuf/exceptions.rb
-- lib/protobuf/field.rb
-- lib/protobuf/field/base_field.rb
-- lib/protobuf/field/base_field_object_definitions.rb
-- lib/protobuf/field/bool_field.rb
-- lib/protobuf/field/bytes_field.rb
-- lib/protobuf/field/double_field.rb
-- lib/protobuf/field/enum_field.rb
-- lib/protobuf/field/field_array.rb
-- lib/protobuf/field/field_hash.rb
-- lib/protobuf/field/fixed32_field.rb
-- lib/protobuf/field/fixed64_field.rb
-- lib/protobuf/field/float_field.rb
-- lib/protobuf/field/int32_field.rb
-- lib/protobuf/field/int64_field.rb
-- lib/protobuf/field/integer_field.rb
-- lib/protobuf/field/message_field.rb
-- lib/protobuf/field/sfixed32_field.rb
-- lib/protobuf/field/sfixed64_field.rb
-- lib/protobuf/field/signed_integer_field.rb
-- lib/protobuf/field/sint32_field.rb
-- lib/protobuf/field/sint64_field.rb
-- lib/protobuf/field/string_field.rb
-- lib/protobuf/field/uint32_field.rb
-- lib/protobuf/field/uint64_field.rb
-- lib/protobuf/field/varint_field.rb
-- lib/protobuf/generators/base.rb
-- lib/protobuf/generators/enum_generator.rb
-- lib/protobuf/generators/extension_generator.rb
-- lib/protobuf/generators/field_generator.rb
-- lib/protobuf/generators/file_generator.rb
-- lib/protobuf/generators/group_generator.rb
-- lib/protobuf/generators/message_generator.rb
-- lib/protobuf/generators/option_generator.rb
-- lib/protobuf/generators/printable.rb
-- lib/protobuf/generators/service_generator.rb
-- lib/protobuf/lifecycle.rb
-- lib/protobuf/logging.rb
-- lib/protobuf/message.rb
-- lib/protobuf/message/fields.rb
-- lib/protobuf/message/serialization.rb
-- lib/protobuf/optionable.rb
-- lib/protobuf/tasks.rb
-- lib/protobuf/tasks/compile.rake
-- lib/protobuf/varint.rb
-- lib/protobuf/varint_pure.rb
-- lib/protobuf/version.rb
-- lib/protobuf/wire_type.rb
-- proto/dynamic_discovery.proto
-- proto/google/protobuf/compiler/plugin.proto
-- proto/google/protobuf/descriptor.proto
-- proto/rpc.proto
 - resources/assess/policy.json
 - resources/deadzone/policy.json
 - resources/inventory/policy.json
 - resources/protect/policy.json
 - resources/test_marker.txt
 - ruby-agent.gemspec
-- service_executables/.gitkeep
-- service_executables/VERSION
-- service_executables/linux/contrast-service
-- service_executables/mac/contrast-service
 - shared_libraries/.gitkeep
 - sonar-project.properties
 homepage: https://www.contrastsecurity.com

data/exe/contrast_service

@@ -1,23 +0,0 @@
-#!/usr/bin/env ruby
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-def mac?
-  RUBY_PLATFORM.include?('darwin')
-end
-
-def path
-  base_path = "#{ File.dirname(__FILE__) }/.."
-  if mac?
-    "#{ base_path }/service_executables/mac/contrast-service"
-  else
-    "#{ base_path }/service_executables/linux/contrast-service"
-  end
-end
-
-executable_path = path
-if File.exist?(executable_path)
-  Kernel.exec(executable_path)
-else
-  puts "Service executable not found at: #{ executable_path }"
-end

data/lib/contrast/agent/protect/rule/cmdi/cmdi_worth_watching.rb

@@ -1,64 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # This module implements the cmdi-worth-watching-v2 check to determine whether input
-        # is IGNORED or WORTH_WATCHING. If WORTH_WATCHING => analyze at sink level.
-        # https://protect-spec.prod.dotnet.contsec.com/rules/cmd-injection.html#input-tracing
-        module CmdiWorthWatching
-          POSSIBLE_CHAINING_ELEMENTS = %w[& ; | $ < > `].cs__freeze
-          UNIX_COMMANDS = %w[
-            uname echo cat ping nestat nc whoami wget curl dir ls ps rm chmod cp kill
-            grep sleep mkdir pwd shutdown system touch timeout fetch bash sh
-          ].cs__freeze
-          UNIX_PATHS = %w[tmp opt etc home mnt proc lib bin sbin sys usr var root run].cs__freeze
-          WINDOWS_COMMANDS = %w[
-            sc net reg cmd query cmd.exe powershell powershell.exe hostname ifconfig ipconfig netsh
-            netstat systeminfo sysinfo whoami wscript cscript wmic PowerShell_ISE pskill psexec qprocess
-            regedit regini rename winrm wpeutil ntdsutil taskkill certutil mapisend shellrunas
-          ].cs__freeze
-          # This method will determine if a user input is Worth watching and return true if it is.
-          # This is done by running checks, and if the inputs is worth to watch it would be
-          # saved for the later sink cmdi input analysis.
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def cmdi_worth_watching? input
-            return false if input.nil? || input.empty? || input.length < 3
-
-            exploitable?(input) && worth_watching?(input)
-          end
-
-          private
-
-          # This method will check if the input is exploitable
-          #
-          # @param input [String] the user input to be inspected
-          def exploitable? input
-            contains_substring?(input, POSSIBLE_CHAINING_ELEMENTS)
-          end
-
-          def worth_watching? input
-            return true if contains_substring?(input, UNIX_COMMANDS)
-            return true if contains_substring?(input, UNIX_PATHS)
-            return true if contains_substring?(input, WINDOWS_COMMANDS)
-
-            false
-          end
-
-          def contains_substring? input, values
-            return true if values.any? { |val| input.include?(val) }
-            return true if values.include?(Contrast::Utils::ObjectShare::SPACE)
-
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/sqli/sqli_worth_watching.rb

@@ -1,118 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # This module implements the sqli-worth-watching-v2 check to determine whether input
-        # is IGNORED or WORTH_WATCHING. If WORTH_WATCHING => analyze at sink level.
-        # https://protect-spec.prod.dotnet.contsec.com/rules/sql-injection.html#input-tracing
-        module SqliWorthWatching
-          COLOR_CODE = /^#[0-9A-Fa-f]{6}$/.cs__freeze
-          ALPHA_NUMERIC_AND_SPACES = /^+[a-zA-Z\d\s]+$/.cs__freeze
-          OR_CLAUSE = /[oO][rR]/.cs__freeze
-          EXPLOITABLE_SUBSTRING = %w[# -- // /*].cs__freeze
-          SUSPICIOUS_CHARS = %w[` " \' ; - % , ( ) | { } =].cs__freeze
-          SQL_COMMENTS = %w[# /* */ // -- @@].cs__freeze
-          BLOCK_START = '/*'.cs__freeze
-          BLOCK_END = '*/'.cs__freeze
-          SQL_KEYWORDS = %w[
-            alter begin between create case column_name
-            current_user delete drop exec execute from
-            group insert limit like merge order outfile
-            select session_user syslogins update union
-            UTL_INADDR UTL_HTTP
-          ].cs__freeze
-
-          # This method will determine if a user input is Worth watching and return true if it is.
-          # This is done by running checks, and if the inputs is worth to watch it would be
-          # saved for the later sink sqli input analysis.
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def sqli_worth_watching? input
-            return false if input.nil? || input.empty?
-
-            exploitable?(input) && (
-              input.match?(OR_CLAUSE) || sql_comments?(input) || suspicious_chars?(input) || language_keywords?(input)
-            )
-          end
-
-          private
-
-          # Check if input is exploitable, with min length set to 3 chars
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def exploitable? input
-            return false if input.length < 3 && input.match?(ALPHA_NUMERIC_AND_SPACES)
-            return false if input.length == 3 && !contains_substring?(input, EXPLOITABLE_SUBSTRING)
-            return false if input.length == 7 && input.match?(COLOR_CODE)
-
-            true
-          end
-
-          # Check if input contains sqli comments:
-          # '# /* */ // -- @@'
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def sql_comments? input
-            input.length >= 3 && contains_substring?(input, SQL_COMMENTS)
-          end
-
-          # Check if input contains block comments starting and
-          # ending with '/*..*/'
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def block_comments? input
-            idx1 = input.index(BLOCK_START)
-            idx2 = input.index(BLOCK_END)
-
-            return false if idx1.nil? || idx2.nil?
-
-            (idx1 >= 0 && idx2 >= 2 && (idx1 < idx2))
-          end
-
-          # Runs the input against suspicious chars array.
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def suspicious_chars? input
-            input.length >= 7 && (number_of_substrings(input, SUSPICIOUS_CHARS) >= 2 || block_comments?(input))
-          end
-
-          # Runs the input against SQL language preserved words.
-          #
-          # @param input [String] the user input to be inspected
-          # @return true | false
-          def language_keywords? input
-            contains_substring?(input, SQL_KEYWORDS)
-          end
-
-          # Helper method to find a substrings in given input.
-          #
-          # @param substrings [Array] set of substrings to inspect.
-          # @return true | false
-          def contains_substring? input, substrings
-            substrings.any? { |sub| input.include?(sub) }
-          end
-
-          # Helper method to find the number of substrings.
-          #
-          # @param input [String] the user input to be inspected
-          # @return number [Integer] Number of substrings
-          def number_of_substrings input, substring
-            number = 0
-            input.each_char.reduce(0) { |_acc, elem| number += 1 if contains_substring?(elem, substring) }
-            number
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_matcher.rb

@@ -1,45 +0,0 @@
-# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # Here will be made the match of the user input provided by the
-        # Agent InputAnalysis.
-        module UnsafeFileUploadMatcher
-          # EXPLOIT_CHARS = %w[.. ; � < > ~ *].cs__freeze # rubocop:disable Style/AsciiComments
-          # # Extensions that can be executed on the server side or can be dangerous on the client side:
-          # # https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
-          # EXPLOITABLE_EXTENSIONS = %w[.php .exe .rb .jsp .pht .phtml .shtml .asa .cer .asax .swf .xap].cs__freeze
-          #
-          # # Match the user input to see if the filename
-          # # contains malicious file extension.
-          # #
-          # # @param input [String] The filename
-          # # extracted from the current request
-          # # @return true | false
-          # def unsafe_match? input
-          #   suspicious_chars?(input) || suspicious_extensions?(input)
-          # end
-          #
-          # private
-          #
-          # # @param input [String] The filename
-          # # extracted from the current request
-          # # @return true | false
-          # def suspicious_chars? input
-          #   input.chars.any? { |c| EXPLOIT_CHARS.include? c }
-          # end
-          #
-          # # @param input [String] The filename
-          # # extracted from the current request
-          # # @return true | false
-          # def suspicious_extensions? input
-          #   EXPLOITABLE_EXTENSIONS.include? File.extname(input).downcase
-          # end
-        end
-      end
-    end
-  end
-end