contrast-agent 6.6.5 → 6.7.0

data/lib/contrast/components/ruby_component.rb

@@ -0,0 +1,81 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module Ruby
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Those in this section pertain to the specific settings that apply to Ruby
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        DISABLED_RAKE_TASK_LIST = %w[
+          about assets:clean assets:clobber assets:environment
+          assets:precompile assets:precompile:all db:create db:drop db:fixtures:load db:migrate
+          db:migrate:status db:rollback db:schema:cache:clear db:schema:cache:dump db:schema:dump
+          db:schema:load db:seed db:setup db:structure:dump db:version doc:app graphql:install graphql:object
+          log:clear middleware notes notes:custom rails:template rails:update routes secret spec spec:features
+          spec:requests spec:controllers spec:helpers spec:models spec:views spec:routing spec:rcov stats
+          test test:all test:all:db test:recent test:single test:uncommitted time:zones:all tmp:clear
+          tmp:create webpacker:compile contrast:service:start contrast:service:status contrast:service:stop
+        ].cs__freeze
+
+        DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
+
+        attr_writer :disabled_agent_rake_tasks, :exceptions, :propagate_yield, :require_scan,
+                    :non_request_tracking, :uninstrument_namespace
+
+        def initialize hsh = {}
+          return unless hsh
+
+          @disabled_agent_rake_tasks = hsh[:disabled_agent_rake_tasks]
+          @exceptions = Contrast::Config::ExceptionConfiguration.new(hsh[:exceptions])
+          @propagate_yield = hsh[:propagate_yield]
+          @require_scan = hsh[:require_scan]
+          @non_request_tracking = hsh[:non_request_tracking]
+          @uninstrument_namespace = hsh[:uninstrument_namespace]
+        end
+
+        # These commands being detected will result the agent disabling instrumentation, generally any command
+        # that doesn't result in the application listening on a port can be added here, this normally includes tasks
+        # that are ran pre-startup(like migrations) or to show information about the application(such as routes)
+        # @return [Array, DISABLED_RAKE_TASK_LIST]
+        def disabled_agent_rake_tasks
+          @disabled_agent_rake_tasks.nil? ? DISABLED_RAKE_TASK_LIST : @disabled_agent_rake_tasks
+        end
+
+        # rubocop:disable Naming/MemoizedInstanceVariableName
+        # @return [Contrast::Config::ExceptionConfiguration]
+        def exceptions
+          @exceptions ||= Contrast::Config::ExceptionConfiguration.new
+        end
+        # rubocop:enable Naming/MemoizedInstanceVariableName
+
+        # controls whether or not we patch the rb_yield block to track split propagation
+        # @return [Boolean, Contrast::Utils::ObjectShare::TRUE]
+        def propagate_yield
+          @propagate_yield.nil? ? Contrast::Utils::ObjectShare::TRUE : @propagate_yield
+        end
+
+        # control whether or not we run file scanning rules on require
+        # @return [Boolean, Contrast::Utils::ObjectShare::TRUE]
+        def require_scan
+          @require_scan.nil? ?  Contrast::Utils::ObjectShare::TRUE  : @require_scan
+        end
+
+        # controls tracking outside of request
+        # @return [Boolean, Contrast::Utils::ObjectShare::FALSE]
+        def non_request_tracking
+          @non_request_tracking.nil? ? Contrast::Utils::ObjectShare::FALSE : @non_request_tracking
+        end
+
+        # @return [Array, DEFAULT_UNINSTRUMENTED_NAMESPACES]
+        def uninstrument_namespace
+          @uninstrument_namespace.nil? ? DEFAULT_UNINSTRUMENTED_NAMESPACES : @uninstrument_namespace
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/sampling.rb

@@ -24,7 +24,7 @@ module Contrast
 
         def sampling_control
           @_sampling_control ||= begin
-            config_settings = ::Contrast::CONFIG.root.assess&.sampling
+            config_settings = ::Contrast::CONFIG.assess&.sampling
             settings = ::Contrast::SETTINGS&.assess_state&.sampling_settings
             {
                 enabled: enabled?(config_settings, settings),

data/lib/contrast/components/security_logger.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module SecurityLogger
+      # Here we will read and store the setting for the CEF Logging functionality
+      class Interface
+        # @return [String, nil]
+        attr_accessor :path
+        # @return [String, nil]
+        attr_accessor :level
+
+        def initialize hsh = {}
+          return unless hsh
+
+          @path = hsh[:path]
+          @level = hsh[:level]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/service.rb

@@ -0,0 +1,55 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+require 'contrast/components/logger'
+
+module Contrast
+  module Components
+    module Service
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Those in this section pertain to the communication between the Agent & the Service
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        # We don't set these b/c we've been asked to handle the default values of these settings differently, logging
+        # when we have to use them.
+        DEFAULT_HOST       = '127.0.0.1' # rubocop:disable Style/IpAddresses
+        DEFAULT_PORT       = '30555'
+
+        attr_writer :logger, :bypass
+        # @return [String, nil]
+        attr_accessor :socket
+        # @return [String, nil]
+        attr_accessor :port
+        # @return [String, nil]
+        attr_accessor :host
+        # @return [Boolean, nil]
+        attr_accessor :enable
+
+        def initialize hsh = {}
+          return unless hsh
+
+          @enable = hsh[:enable]
+          @host = hsh[:host]
+          @port = hsh[:port]
+          @socket = hsh[:socket]
+          @logger = Contrast::Components::Logger::Interface.new(hsh[:logger])
+          @bypass = hsh[:bypass]
+        end
+
+        # @return [Contrast::Components::Logger::Interface]
+        def logger
+          @logger ||= Contrast::Components::Logger::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+        end
+
+        # @return [Boolean, false]
+        def bypass
+          @bypass.nil? ? false : @bypass
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/settings.rb

@@ -2,7 +2,9 @@
 # frozen_string_literal: true
 
 require 'contrast/api/settings.pb'
+require 'contrast/agent/excluder'
 require 'contrast/agent/reporting/settings/sensitive_data_masking'
+require 'contrast/components/config'
 
 module Contrast
   module Components
@@ -24,7 +26,7 @@ module Contrast
       SENSITIVE_DATA_MASKING_BASE = Contrast::Agent::Reporting::Settings::SensitiveDataMasking.new
 
       # This is a class.
-      class Interface
+      class Interface # rubocop:disable Metrics/ClassLength
         extend Contrast::Components::Config
 
         # tainted_columns are database columns that receive unsanitized input.
@@ -90,6 +92,8 @@ module Contrast
         attr_reader :last_app_update_ms
         # @return [Integer] the time, in ms, that server settings last changed
         attr_reader :last_server_update_ms
+        # @return [Contrast::Agent::Excluder] a wrapper around the exclusion rules for the application
+        attr_reader :excluder
 
         def initialize
           reset_state
@@ -120,7 +124,11 @@ module Contrast
             new_vals = settings_response.application_state_translation
             @application_state.modes_by_id = new_vals[:modes_by_id]
             @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
+            @excluder = Contrast::Agent::Excluder.new(@application_state.exclusion_matchers)
             @assess_state.disabled_assess_rules = new_vals[:disabled_assess_rules]
+            if settings_response.session_id && !settings_response.session_id.blank?
+              @assess_state.session_id = settings_response.session_id
+            end
             @last_app_update_ms = Contrast::Utils::Timer.now_ms
           end
           @last_app_update_ms = Contrast::Utils::Timer.now_ms
@@ -133,6 +141,7 @@ module Contrast
           @application_state = APPLICATION_STATE_BASE.dup
           @tainted_columns = {}
           @sensitive_data_masking = SENSITIVE_DATA_MASKING_BASE.dup
+          @excluder = Contrast::Agent::Excluder.new
         end
 
         def build_protect_rules
@@ -202,9 +211,8 @@ module Contrast
           # @application_state.exclusion_matchers = new_vals[:exclusion_matchers]
           update_sensitive_data_policy(app_settings.sensitive_data_masking)
           @assess_state.disabled_assess_rules = app_settings.assess.disabled_rules
-          if app_settings.assess.session_id && !app_settings.assess.session_id.blank?
-            @assess_state.session_id = app_settings.assess.session_id
-          end
+          new_session_id = app_settings.assess.session_id
+          @assess_state.session_id = new_session_id if new_session_id && !new_session_id.blank?
           @last_app_update_ms = Contrast::Utils::Timer.now_ms
         end
 

data/lib/contrast/config/base_configuration.rb

@@ -12,7 +12,7 @@ module Contrast
       extend Forwardable
       AT_UNDERSCORE = '@_'
 
-      def to_hash
+      def to_contrast_hash
         hsh = {}
         instance_variables.each do |iv|
           # strip the '@' of '@_' to get the key

data/lib/contrast/config/protect_rules_configuration.rb

@@ -11,11 +11,12 @@ module Contrast
 
       attr_accessor :disabled_rules
       attr_writer :bot_blocker, :cmd_injection, :sql_injection, :nosql_injection, :untrusted_deserialization,
-                  :xxe, :path_traversal, :reflected_xss, :unsafe_file_upload, :rule_base
+                  :xxe, :path_traversal, :reflected_xss, :unsafe_file_upload, :rule_base, :cmdi_command_backdoors,
+                  :sqli_dangerous_function
 
       BASE_RULE = 'Contrast::Agent::Protect::Rule::Base'.cs__freeze
 
-      def initialize hsh = {}
+      def initialize hsh = {} # rubocop:disable Metrics/AbcSize
         return unless hsh
 
         @disabled_rules = hsh[:disabled_rules]
@@ -27,8 +28,13 @@ module Contrast
         @path_traversal = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'path-traversal'])
         @reflected_xss = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'reflected-xss'])
         @sql_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection'])
+        @sqli_dangerous_function =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection-semantic-dangerous-functions'])
         @unsafe_file_upload = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'unsafe-file-upload'])
         @untrusted_deserialization = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'untrusted-deserialization'])
+        @cmdi_command_backdoors = Contrast::Config::ProtectRuleConfiguration.new(hsh[
+                                                                                   :'cmd-injection-command-backdoors'
+                                                                                 ])
         @xxe = Contrast::Config::ProtectRuleConfiguration.new(hsh[:xxe])
       end
 
@@ -72,10 +78,18 @@ module Contrast
         @unsafe_file_upload ||= Contrast::Config::ProtectRuleConfiguration.new
       end
 
+      def cmdi_command_backdoors
+        @cmdi_command_backdoors ||= Contrast::Config::ProtectRuleConfiguration.new
+      end
+
       def rule_base
         @rule_base ||= Contrast::Config::ProtectRuleConfiguration.new
       end
 
+      def sqli_dangerous_function
+        @sqli_dangerous_function = Contrast::Config::ProtectRuleConfiguration.new
+      end
+
       def []= key, value
         instance_variable_set("@#{ convert_key(key) }".to_sym, value)
       end
@@ -90,7 +104,7 @@ module Contrast
 
       # Convert instance variable names to format expected by TS
       # for adding to the hash
-      def to_hash
+      def to_contrast_hash
         hsh = {}
         instance_variables.each do |iv|
           # strip the '@' to get the key

data/lib/contrast/config/server_configuration.rb

@@ -9,7 +9,7 @@ module Contrast
       include Contrast::Config::BaseConfiguration
 
       # @return [String, nil]
-      attr_accessor :name
+      attr_reader :name
       # @return [String, nil]
       attr_accessor :path
       # @return [String, nil]

data/lib/contrast/config.rb

@@ -11,13 +11,7 @@ module Contrast
 end
 
 require 'contrast/config/base_configuration'
-require 'contrast/config/service_configuration'
 require 'contrast/config/exception_configuration'
-require 'contrast/config/assess_rules_configuration'
 require 'contrast/config/protect_rule_configuration'
 require 'contrast/config/protect_rules_configuration'
-
-require 'contrast/config/ruby_configuration'
 require 'contrast/config/server_configuration'
-require 'contrast/config/assess_configuration'
-require 'contrast/config/root_configuration'

data/lib/contrast/configuration.rb

@@ -6,7 +6,15 @@ require 'fileutils'
 
 require 'contrast/config'
 require 'contrast/utils/object_share'
+require 'contrast/components/agent'
+require 'contrast/components/api'
+require 'contrast/components/app_context'
 require 'contrast/components/scope'
+require 'contrast/components/inventory'
+require 'contrast/components/protect'
+require 'contrast/components/assess'
+require 'contrast/components/service'
+require 'contrast/config/server_configuration'
 
 module Contrast
   # This is how we read in the local settings for the Agent, both ENV/ CMD line
@@ -18,7 +26,28 @@ module Contrast
     include Contrast::Components::Scope::InstanceMethods
     extend Contrast::Components::Scope::InstanceMethods
 
-    attr_reader :default_name, :root
+    include Contrast::Config::BaseConfiguration
+
+    attr_reader :default_name
+
+    # @return [Contrast::Components::Api::Interface]
+    attr_writer :api
+    # @return [Contrast::Components::Agent::Interface]
+    attr_writer :agent
+    # @return [Contrast::Components::AppContext::Interface]
+    attr_writer :application
+    # @return [Contrast::Config::ServerConfiguration]
+    attr_writer :server
+    # @return [Contrast::Components::Assess::Interface]
+    attr_writer :assess
+    # @return [Contrast::Components::Inventory::Interface]
+    attr_writer :inventory
+    # @return [Contrast::Components::Protect::Interface]
+    attr_writer :protect
+    # @return [Contrast::Components::Service::Interface]
+    attr_writer :service
+    # @return [Boolean, nil]
+    attr_accessor :enable
 
     DEFAULT_YAML_PATH  = 'contrast_security.yaml'
     MILLISECOND_MARKER = '_ms'
@@ -40,20 +69,15 @@ module Contrast
       # Some in-flight rewrites to maintain backwards compatibility
       config_kv = update_prop_keys(config_kv)
 
-      @root = Contrast::Config::RootConfiguration.new(config_kv)
-    end
-
-    # Because we call this method to determine the need for scoping, it itself
-    # must be executed inside a Contrast scope. Failure to do so could result
-    # in an infinite loop on the to_sym method used later.
-    def method_missing symbol, *args
-      with_contrast_scope do
-        root.public_send(symbol, *args) if root.cs__respond_to?(symbol)
-      end
-    end
-
-    def respond_to_missing? method_name, *args
-      root&.cs__respond_to?(method_name) || super
+      @api = Contrast::Components::Api::Interface.new(config_kv[:api])
+      @enable = config_kv[:enable]
+      @agent = Contrast::Components::Agent::Interface.new(config_kv[:agent])
+      @application = Contrast::Components::AppContext::Interface.new(config_kv[:application])
+      @server = Contrast::Config::ServerConfiguration.new(config_kv[:server])
+      @assess = Contrast::Components::Assess::Interface.new(config_kv[:assess])
+      @inventory = Contrast::Components::Inventory::Interface.new(config_kv[:inventory])
+      @protect = Contrast::Components::Protect::Interface.new(config_kv[:protect])
+      @service = Contrast::Components::Service::Interface.new(config_kv[:service])
     end
 
     # Get a loggable YAML format of this configuration
@@ -63,6 +87,46 @@ module Contrast
       convert_to_hash.to_yaml
     end
 
+    # @return [Contrast::Components::Api::Interface]
+    def api
+      @api ||= Contrast::Components::Api::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Agent::Interface]
+    def agent
+      @agent ||= Contrast::Components::Agent::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::AppContext::Interface]
+    def application
+      @application ||= Contrast::Components::AppContext::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Config::ServerConfiguration]
+    def server
+      @server ||= Contrast::Config::ServerConfiguration.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Assess::Interface]
+    def assess
+      @assess ||= Contrast::Components::Assess::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Inventory::Interface]
+    def inventory
+      @inventory ||= Contrast::Components::Inventory::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Protect::Interface]
+    def protect
+      @protect ||= Contrast::Components::Protect::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    # @return [Contrast::Components::Service::Interface]
+    def service
+      @service ||= Contrast::Components::Service::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
     protected
 
     # TODO: RUBY-546 move utility methods to auxiliary classes
@@ -213,11 +277,11 @@ module Contrast
     # @return [Hash, Object] the leaf of each
     #   Contrast::Config::BaseConfiguration will be returned in the N > 0 steps
     #   the Hash will be returned at the end of the 0 level
-    def convert_to_hash convert = root, hash = {}
+    def convert_to_hash convert = self, hash = {}
       case convert
       when Contrast::Config::BaseConfiguration
         # to_hash returns @configuration_map
-        convert.to_hash.each_key do |key|
+        convert.to_contrast_hash.each_key do |key|
           # change '-' to '_' for ProtectRulesConfiguration
           hash[key] = convert_to_hash(convert.send(key.tr('-', '_').to_sym), {})
           hash[key] = REDACTED if redactable?(key)

data/lib/contrast/extension/assess/exec_trigger.rb

@@ -19,7 +19,9 @@ module Contrast
           # source might not be all the args passed in, but it is the one we care
           # about. we could pass in all the args in the last param here if it
           # becomes an issue in rendering on TS
-          Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node, source, Kernel, nil, source)
+          finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node,
+                                                                                 source, Kernel, nil, source)
+          Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
         end
 
         private

data/lib/contrast/extension/assess/marshal.rb

@@ -36,8 +36,9 @@ module Contrast
               # source might not be all the args passed in, but it is the one we care
               # about. we could pass in all the args in the last param here if it
               # becomes an issue in rendering on TS
-              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load), source,
-                                                                           self, ret, *args)
+              finding = Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node('Marshal', :load),
+                                                                                     source, self, ret, *args)
+              Contrast::Agent::Assess::Policy::TriggerMethod.report_finding(finding) if finding
               return unless (properties = Contrast::Agent::Assess::Tracker.properties!(ret))
 
               properties.copy_from(source, ret)

data/lib/contrast/extension/assess/string.rb

@@ -37,7 +37,6 @@ module Contrast
           # @param inputs [Array<String>] Inputs for interpolation.
           # @param result [String] The result from the interpolation.
           def track_interpolation inputs, result
-            return unless ::Contrast::AGENT.interpolation_enabled?
             return unless inputs.any? { |input| Contrast::Agent::Assess::Tracker.tracked?(input) }
             return unless (properties = Contrast::Agent::Assess::Tracker.properties!(result))
 

data/lib/contrast/extension/extension.rb

@@ -36,7 +36,7 @@ module Contrast
           # conditions
           def assign_value path
             case path
-            when /fiber/, /interpolation26/
+            when /fiber/, /interpolation/
               require(path) if Funchook.available?
             else
               require(path)

data/lib/contrast/framework/base_support.rb

@@ -41,11 +41,6 @@ module Contrast
         raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
       end
 
-      # @raise [NoMethodError] raises error if subclass does not implement this method
-      def current_route
-        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
-      end
-
       # @raise [NoMethodError] raises error if subclass does not implement this method
       def retrieve_request _env
         raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')

data/lib/contrast/framework/grape/support.rb

@@ -68,29 +68,6 @@ module Contrast
             routes
           end
 
-          # Given the current request return a RouteCoverage dtm.
-          #
-          # @param request [Contrast::Agent::Request] a contrast tracked request.
-          # @param controller [::Grape::API] optionally use this controller instead of global ::Grape::API.
-          # @return [Contrast::Api::Dtm::RouteCoverage, nil] a Dtm describing the route
-          # matched to the request if a match was found.
-          def current_route request, controller = ::Grape::API, full_route = nil
-            return unless grape_controller?(controller)
-
-            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
-
-            # Find final controller - actually we gotta match the route to the scanned application
-            # Initially Grape compiles all routes on startup, so we can use the url from the request
-            # and create the observed route
-            # Class < Grape::API, Grape::Router::Route
-            final_controller, route_pattern = _route_recurse(method, _cleaned_route(request), grape_controllers)
-            return unless final_controller
-
-            full_route ||= request.env[::Rack::PATH_INFO]
-
-            Contrast::Api::Dtm::RouteCoverage.from_grape_controller(final_controller, method, route_pattern, full_route)
-          end
-
           # Given the current request - return a RouteCoverage object
 
           # @param request [Contrast::Agent::Request] a contrast tracked request.
@@ -113,6 +90,7 @@ module Contrast
 
             new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
             new_route_coverage.attach_rack_based_data(final_controller, method, route_pattern, full_route)
+            new_route_coverage
           end
 
           # Search object space for grape controllers--any class that subclasses ::Grape::API.

data/lib/contrast/framework/manager.rb

@@ -108,16 +108,6 @@ module Contrast
         result
       end
 
-      # Iterate through current frameworks and return the current request's route. This will be the first non-nil
-      # result.
-      #
-      # @param request [Contrast::Agent::Request] the current request.
-      # @return [Contrast::Api::Dtm::RouteCoverage] the current route as a Dtm.
-      def get_route_dtm request
-        @_frameworks.lazy.map { |framework_support| framework_support.current_route(request) }.
-            reject(&:nil?).first # rubocop:disable Style/CollectionCompact
-      end
-
       # Iterate through current frameworks and return the current request's route. This will be the first non-nil
       # result.
       #