contrast-agent 6.7.0 → 6.9.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (280) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +0 -2
  3. data/.simplecov +0 -1
  4. data/Rakefile +0 -1
  5. data/ext/cs__assess_array/cs__assess_array.c +41 -10
  6. data/ext/cs__assess_array/cs__assess_array.h +4 -1
  7. data/lib/contrast/agent/assess/policy/trigger_method.rb +3 -3
  8. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
  9. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  10. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -1
  11. data/lib/contrast/agent/assess/property/evented.rb +11 -11
  12. data/lib/contrast/agent/assess.rb +0 -1
  13. data/lib/contrast/agent/excluder.rb +53 -35
  14. data/lib/contrast/agent/exclusion_matcher.rb +21 -9
  15. data/lib/contrast/agent/middleware.rb +12 -6
  16. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -0
  17. data/lib/contrast/agent/protect/input_analyzer/input_analyzer.rb +146 -127
  18. data/lib/contrast/agent/protect/input_analyzer/worth_watching_analyzer.rb +116 -0
  19. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +20 -0
  20. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  21. data/lib/contrast/agent/protect/rule/base.rb +47 -55
  22. data/lib/contrast/agent/protect/rule/base_service.rb +48 -24
  23. data/lib/contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification.rb +98 -0
  24. data/lib/contrast/agent/protect/rule/bot_blocker.rb +81 -0
  25. data/lib/contrast/agent/protect/rule/cmd_injection.rb +20 -2
  26. data/lib/contrast/agent/protect/rule/cmdi/cmdi_backdoors.rb +8 -5
  27. data/lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb +22 -22
  28. data/lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb +64 -0
  29. data/lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb +63 -0
  30. data/lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb +2 -58
  31. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  32. data/lib/contrast/agent/protect/rule/deserialization.rb +3 -14
  33. data/lib/contrast/agent/protect/rule/http_method_tampering/http_method_tampering_input_classification.rb +2 -2
  34. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +0 -11
  35. data/lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb +29 -34
  36. data/lib/contrast/agent/protect/rule/no_sqli.rb +25 -18
  37. data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb +61 -0
  38. data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb +114 -0
  39. data/lib/contrast/agent/protect/rule/path_traversal.rb +40 -13
  40. data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +33 -15
  41. data/lib/contrast/agent/protect/rule/sqli/sqli_base_rule.rb +0 -14
  42. data/lib/contrast/agent/protect/rule/sqli/sqli_input_classification.rb +2 -62
  43. data/lib/contrast/agent/protect/rule/sqli.rb +74 -3
  44. data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification.rb +39 -63
  45. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +6 -33
  46. data/lib/contrast/agent/protect/rule/xss/reflected_xss_input_classification.rb +58 -0
  47. data/lib/contrast/agent/protect/rule/xss.rb +15 -20
  48. data/lib/contrast/agent/protect/rule/xxe.rb +4 -24
  49. data/lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb +19 -40
  50. data/lib/contrast/agent/reporting/attack_result/response_type.rb +9 -9
  51. data/lib/contrast/agent/reporting/details/ip_denylist_details.rb +10 -2
  52. data/lib/contrast/agent/reporting/details/virtual_patch_details.rb +8 -2
  53. data/lib/contrast/agent/reporting/input_analysis/details/bot_blocker_details.rb +27 -0
  54. data/lib/contrast/agent/reporting/input_analysis/details/protect_rule_details.rb +15 -0
  55. data/lib/contrast/agent/reporting/input_analysis/input_analysis.rb +1 -2
  56. data/lib/contrast/agent/reporting/input_analysis/input_analysis_result.rb +16 -2
  57. data/lib/contrast/agent/reporting/masker/masker.rb +2 -0
  58. data/lib/contrast/agent/reporting/report.rb +1 -0
  59. data/lib/contrast/agent/reporting/reporter.rb +35 -14
  60. data/lib/contrast/agent/reporting/reporter_heartbeat.rb +3 -9
  61. data/lib/contrast/agent/reporting/reporting_events/application_activity.rb +16 -13
  62. data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb +12 -7
  63. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb +3 -3
  64. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb +1 -2
  65. data/lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb +6 -1
  66. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +0 -2
  67. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +0 -1
  68. data/lib/contrast/agent/reporting/reporting_events/finding.rb +6 -6
  69. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +239 -93
  70. data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -23
  71. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +10 -9
  72. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +0 -5
  73. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +0 -1
  74. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +12 -0
  75. data/lib/contrast/agent/reporting/reporting_events/poll.rb +1 -11
  76. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +0 -1
  77. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +0 -1
  78. data/lib/contrast/agent/reporting/reporting_events/server_reporting_event.rb +8 -0
  79. data/lib/contrast/agent/reporting/reporting_events/server_settings.rb +40 -0
  80. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +2 -2
  81. data/lib/contrast/agent/reporting/reporting_utilities/endpoints.rb +6 -0
  82. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +43 -1
  83. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +8 -4
  84. data/lib/contrast/agent/reporting/reporting_utilities/response.rb +1 -1
  85. data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb +58 -4
  86. data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +4 -6
  87. data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +77 -16
  88. data/lib/contrast/agent/reporting/server_settings_worker.rb +44 -0
  89. data/lib/contrast/agent/reporting/settings/assess_server_feature.rb +14 -2
  90. data/lib/contrast/agent/reporting/settings/code_exclusion.rb +6 -1
  91. data/lib/contrast/agent/reporting/settings/exclusion_base.rb +18 -0
  92. data/lib/contrast/agent/reporting/settings/exclusions.rb +2 -1
  93. data/lib/contrast/agent/reporting/settings/helpers.rb +7 -0
  94. data/lib/contrast/agent/reporting/settings/input_exclusion.rb +9 -3
  95. data/lib/contrast/agent/reporting/settings/protect.rb +15 -15
  96. data/lib/contrast/agent/reporting/settings/protect_server_feature.rb +39 -2
  97. data/lib/contrast/agent/reporting/settings/rule_definition.rb +3 -0
  98. data/lib/contrast/agent/reporting/settings/security_logger.rb +77 -0
  99. data/lib/contrast/agent/reporting/settings/server_features.rb +9 -0
  100. data/lib/contrast/agent/reporting/settings/syslog.rb +34 -5
  101. data/lib/contrast/agent/request.rb +3 -14
  102. data/lib/contrast/agent/request_context.rb +6 -9
  103. data/lib/contrast/agent/request_context_extend.rb +9 -148
  104. data/lib/contrast/agent/request_handler.rb +5 -10
  105. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +1 -1
  106. data/lib/contrast/agent/thread_watcher.rb +37 -18
  107. data/lib/contrast/agent/version.rb +1 -1
  108. data/lib/contrast/agent.rb +6 -11
  109. data/lib/contrast/agent_lib/api/command_injection.rb +46 -0
  110. data/lib/contrast/agent_lib/api/init.rb +101 -0
  111. data/lib/contrast/agent_lib/api/input_tracing.rb +267 -0
  112. data/lib/contrast/agent_lib/api/method_tempering.rb +29 -0
  113. data/lib/contrast/agent_lib/api/panic.rb +87 -0
  114. data/lib/contrast/agent_lib/api/path_semantic_file_security_bypass.rb +40 -0
  115. data/lib/contrast/agent_lib/interface.rb +260 -0
  116. data/lib/contrast/agent_lib/interface_base.rb +118 -0
  117. data/lib/contrast/agent_lib/return_types/eval_result.rb +44 -0
  118. data/lib/contrast/agent_lib/test.rb +29 -0
  119. data/lib/contrast/api/communication/connection_status.rb +20 -5
  120. data/lib/contrast/components/agent.rb +34 -14
  121. data/lib/contrast/components/api.rb +23 -0
  122. data/lib/contrast/components/app_context.rb +23 -5
  123. data/lib/contrast/components/app_context_extend.rb +0 -25
  124. data/lib/contrast/components/assess.rb +34 -4
  125. data/lib/contrast/components/assess_rules.rb +18 -0
  126. data/lib/contrast/components/base.rb +40 -0
  127. data/lib/contrast/components/config/sources.rb +95 -0
  128. data/lib/contrast/components/config.rb +19 -19
  129. data/lib/contrast/components/heap_dump.rb +10 -0
  130. data/lib/contrast/components/inventory.rb +15 -2
  131. data/lib/contrast/components/logger.rb +18 -0
  132. data/lib/contrast/components/polling.rb +36 -0
  133. data/lib/contrast/components/protect.rb +52 -2
  134. data/lib/contrast/components/ruby_component.rb +16 -1
  135. data/lib/contrast/components/sampling.rb +70 -13
  136. data/lib/contrast/components/security_logger.rb +13 -0
  137. data/lib/contrast/components/settings.rb +105 -90
  138. data/lib/contrast/config/certification_configuration.rb +14 -0
  139. data/lib/contrast/config/config.rb +46 -0
  140. data/lib/contrast/config/diagnostics.rb +114 -0
  141. data/lib/contrast/config/diagnostics_tools.rb +98 -0
  142. data/lib/contrast/config/effective_config.rb +65 -0
  143. data/lib/contrast/config/effective_config_value.rb +32 -0
  144. data/lib/contrast/config/exception_configuration.rb +12 -0
  145. data/lib/contrast/config/protect_rule_configuration.rb +8 -8
  146. data/lib/contrast/config/protect_rules_configuration.rb +23 -60
  147. data/lib/contrast/config/request_audit_configuration.rb +13 -0
  148. data/lib/contrast/config/server_configuration.rb +41 -2
  149. data/lib/contrast/configuration.rb +29 -12
  150. data/lib/contrast/extension/assess/array.rb +9 -0
  151. data/lib/contrast/extension/assess/erb.rb +1 -1
  152. data/lib/contrast/extension/delegator.rb +2 -0
  153. data/lib/contrast/framework/manager.rb +3 -1
  154. data/lib/contrast/framework/rails/railtie.rb +0 -1
  155. data/lib/contrast/framework/rails/support.rb +0 -1
  156. data/lib/contrast/tasks/config.rb +1 -8
  157. data/lib/contrast/utils/assess/event_limit_utils.rb +31 -9
  158. data/lib/contrast/utils/assess/trigger_method_utils.rb +5 -4
  159. data/lib/contrast/utils/duck_utils.rb +1 -0
  160. data/lib/contrast/utils/hash_digest.rb +2 -2
  161. data/lib/contrast/utils/input_classification_base.rb +155 -0
  162. data/lib/contrast/utils/os.rb +0 -20
  163. data/lib/contrast/utils/reporting/application_activity_batch_utils.rb +81 -0
  164. data/lib/contrast/utils/response_utils.rb +0 -16
  165. data/lib/contrast/utils/routes_sent.rb +60 -0
  166. data/lib/contrast/utils/stack_trace_utils.rb +3 -15
  167. data/lib/contrast/utils/string_utils.rb +10 -7
  168. data/lib/contrast/utils/telemetry_client.rb +1 -2
  169. data/lib/contrast/utils/timer.rb +16 -0
  170. data/lib/contrast.rb +5 -4
  171. data/resources/protect/policy.json +1 -2
  172. data/ruby-agent.gemspec +7 -6
  173. metadata +69 -130
  174. data/exe/contrast_service +0 -23
  175. data/lib/contrast/agent/assess/contrast_event.rb +0 -157
  176. data/lib/contrast/agent/assess/events/event_factory.rb +0 -34
  177. data/lib/contrast/agent/assess/events/source_event.rb +0 -46
  178. data/lib/contrast/agent/protect/rule/cmdi/cmdi_worth_watching.rb +0 -64
  179. data/lib/contrast/agent/protect/rule/sqli/sqli_worth_watching.rb +0 -118
  180. data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_matcher.rb +0 -45
  181. data/lib/contrast/agent/reaction_processor.rb +0 -47
  182. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -36
  183. data/lib/contrast/agent/service_heartbeat.rb +0 -35
  184. data/lib/contrast/api/communication/messaging_queue.rb +0 -128
  185. data/lib/contrast/api/communication/response_processor.rb +0 -90
  186. data/lib/contrast/api/communication/service_lifecycle.rb +0 -77
  187. data/lib/contrast/api/communication/socket.rb +0 -44
  188. data/lib/contrast/api/communication/socket_client.rb +0 -130
  189. data/lib/contrast/api/communication/speedracer.rb +0 -138
  190. data/lib/contrast/api/communication/tcp_socket.rb +0 -32
  191. data/lib/contrast/api/communication/unix_socket.rb +0 -28
  192. data/lib/contrast/api/communication.rb +0 -20
  193. data/lib/contrast/api/decorators/address.rb +0 -59
  194. data/lib/contrast/api/decorators/agent_startup.rb +0 -56
  195. data/lib/contrast/api/decorators/application_settings.rb +0 -43
  196. data/lib/contrast/api/decorators/application_startup.rb +0 -56
  197. data/lib/contrast/api/decorators/bot_blocker.rb +0 -37
  198. data/lib/contrast/api/decorators/http_request.rb +0 -137
  199. data/lib/contrast/api/decorators/input_analysis.rb +0 -18
  200. data/lib/contrast/api/decorators/instrumentation_mode.rb +0 -35
  201. data/lib/contrast/api/decorators/ip_denylist.rb +0 -37
  202. data/lib/contrast/api/decorators/message.rb +0 -67
  203. data/lib/contrast/api/decorators/rasp_rule_sample.rb +0 -52
  204. data/lib/contrast/api/decorators/response_type.rb +0 -17
  205. data/lib/contrast/api/decorators/server_features.rb +0 -25
  206. data/lib/contrast/api/decorators/user_input.rb +0 -51
  207. data/lib/contrast/api/decorators/virtual_patch.rb +0 -34
  208. data/lib/contrast/api/decorators.rb +0 -22
  209. data/lib/contrast/api/dtm.pb.rb +0 -363
  210. data/lib/contrast/api/settings.pb.rb +0 -500
  211. data/lib/contrast/api.rb +0 -16
  212. data/lib/contrast/components/contrast_service.rb +0 -88
  213. data/lib/contrast/components/service.rb +0 -55
  214. data/lib/contrast/tasks/service.rb +0 -84
  215. data/lib/contrast/utils/input_classification.rb +0 -73
  216. data/lib/protobuf/code_generator.rb +0 -129
  217. data/lib/protobuf/decoder.rb +0 -28
  218. data/lib/protobuf/deprecation.rb +0 -117
  219. data/lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb +0 -79
  220. data/lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb +0 -360
  221. data/lib/protobuf/descriptors.rb +0 -3
  222. data/lib/protobuf/encoder.rb +0 -11
  223. data/lib/protobuf/enum.rb +0 -365
  224. data/lib/protobuf/exceptions.rb +0 -9
  225. data/lib/protobuf/field/base_field.rb +0 -380
  226. data/lib/protobuf/field/base_field_object_definitions.rb +0 -504
  227. data/lib/protobuf/field/bool_field.rb +0 -64
  228. data/lib/protobuf/field/bytes_field.rb +0 -67
  229. data/lib/protobuf/field/double_field.rb +0 -25
  230. data/lib/protobuf/field/enum_field.rb +0 -56
  231. data/lib/protobuf/field/field_array.rb +0 -102
  232. data/lib/protobuf/field/field_hash.rb +0 -122
  233. data/lib/protobuf/field/fixed32_field.rb +0 -25
  234. data/lib/protobuf/field/fixed64_field.rb +0 -28
  235. data/lib/protobuf/field/float_field.rb +0 -43
  236. data/lib/protobuf/field/int32_field.rb +0 -21
  237. data/lib/protobuf/field/int64_field.rb +0 -34
  238. data/lib/protobuf/field/integer_field.rb +0 -23
  239. data/lib/protobuf/field/message_field.rb +0 -51
  240. data/lib/protobuf/field/sfixed32_field.rb +0 -27
  241. data/lib/protobuf/field/sfixed64_field.rb +0 -28
  242. data/lib/protobuf/field/signed_integer_field.rb +0 -29
  243. data/lib/protobuf/field/sint32_field.rb +0 -21
  244. data/lib/protobuf/field/sint64_field.rb +0 -21
  245. data/lib/protobuf/field/string_field.rb +0 -51
  246. data/lib/protobuf/field/uint32_field.rb +0 -21
  247. data/lib/protobuf/field/uint64_field.rb +0 -21
  248. data/lib/protobuf/field/varint_field.rb +0 -77
  249. data/lib/protobuf/field.rb +0 -74
  250. data/lib/protobuf/generators/base.rb +0 -85
  251. data/lib/protobuf/generators/enum_generator.rb +0 -39
  252. data/lib/protobuf/generators/extension_generator.rb +0 -27
  253. data/lib/protobuf/generators/field_generator.rb +0 -193
  254. data/lib/protobuf/generators/file_generator.rb +0 -262
  255. data/lib/protobuf/generators/group_generator.rb +0 -122
  256. data/lib/protobuf/generators/message_generator.rb +0 -104
  257. data/lib/protobuf/generators/option_generator.rb +0 -17
  258. data/lib/protobuf/generators/printable.rb +0 -160
  259. data/lib/protobuf/generators/service_generator.rb +0 -50
  260. data/lib/protobuf/lifecycle.rb +0 -33
  261. data/lib/protobuf/logging.rb +0 -39
  262. data/lib/protobuf/message/fields.rb +0 -233
  263. data/lib/protobuf/message/serialization.rb +0 -85
  264. data/lib/protobuf/message.rb +0 -241
  265. data/lib/protobuf/optionable.rb +0 -72
  266. data/lib/protobuf/tasks/compile.rake +0 -80
  267. data/lib/protobuf/tasks.rb +0 -1
  268. data/lib/protobuf/varint.rb +0 -20
  269. data/lib/protobuf/varint_pure.rb +0 -31
  270. data/lib/protobuf/version.rb +0 -3
  271. data/lib/protobuf/wire_type.rb +0 -10
  272. data/lib/protobuf.rb +0 -91
  273. data/proto/dynamic_discovery.proto +0 -46
  274. data/proto/google/protobuf/compiler/plugin.proto +0 -183
  275. data/proto/google/protobuf/descriptor.proto +0 -911
  276. data/proto/rpc.proto +0 -71
  277. data/service_executables/.gitkeep +0 -0
  278. data/service_executables/VERSION +0 -1
  279. data/service_executables/linux/contrast-service +0 -0
  280. data/service_executables/mac/contrast-service +0 -0
@@ -1,20 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Api
6
- # Used to contain all modules that handle communication with speedracer
7
- module Communication
8
- end
9
- end
10
- end
11
-
12
- require 'contrast/api/communication/service_lifecycle'
13
- require 'contrast/api/communication/connection_status'
14
- require 'contrast/api/communication/socket'
15
- require 'contrast/api/communication/tcp_socket'
16
- require 'contrast/api/communication/unix_socket'
17
- require 'contrast/api/communication/socket_client'
18
- require 'contrast/api/communication/messaging_queue'
19
- require 'contrast/api/communication/response_processor'
20
- require 'contrast/api/communication/speedracer'
@@ -1,59 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/components/logger'
6
- require 'contrast/utils/string_utils'
7
- require 'contrast/utils/timer'
8
-
9
- module Contrast
10
- module Api
11
- module Decorators
12
- # Used to decorate the {Contrast::Api::Dtm::Address} protobuf model so it
13
- # can own some of the data massaging required for Request dtm. Only works
14
- # as an extension of that class.
15
- module Address
16
- def self.included klass
17
- klass.extend(ClassMethods)
18
- end
19
-
20
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
21
- module ClassMethods
22
- include Contrast::Components::Logger::InstanceMethods
23
- # receiver is memoized because it is the address/host/port of the server, once we
24
- # resolve this for the first time, it shouldn't change
25
- #
26
- # @return [Contrast::Api::Dtm::Address] the address of this server
27
- def build_receiver
28
- @_build_receiver ||= begin
29
- address = new
30
- address.host = 'localhost'
31
- address.ip = '127.0.0.1' # rubocop:disable Style/IpAddresses
32
- begin
33
- Timeout.timeout(1) do
34
- address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
35
- address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
36
- end
37
- rescue StandardError => e
38
- logger.warn('Unable to resolve host or ip', e, address: address)
39
- end
40
- address
41
- end
42
- end
43
-
44
- # Parse out the sender of the Request and return it as an Address
45
- #
46
- # @return [Contrast::Api::Dtm::Address] the address from which the
47
- # request originated
48
- def build_sender request
49
- sender = new
50
- sender.ip = Contrast::Utils::StringUtils.force_utf8(request.ip)
51
- sender
52
- end
53
- end
54
- end
55
- end
56
- end
57
- end
58
-
59
- Contrast::Api::Dtm::Address.include(Contrast::Api::Decorators::Address)
@@ -1,56 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/utils/string_utils'
6
- require 'contrast/components/base'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the AgentStartup protobuf model to handle reporting Agent process start
12
- module AgentStartup
13
- include Contrast::Components::ComponentBase
14
-
15
- def self.included klass
16
- klass.extend(ClassMethods)
17
- end
18
-
19
- # Used to add class methods to the AgentStartup class on inclusion of the decorator
20
- module ClassMethods
21
- # Return a new DTM with the values from the configuration and Agent discovery
22
- #
23
- # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
24
- # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
25
- # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
26
- # @return [Contrast::Api::Dtm::AgentStartup]
27
- def build name, path, type
28
- msg = new
29
- msg.server_version = Contrast::Agent::VERSION
30
- msg.server_name = Contrast::Utils::StringUtils.protobuf_format(name)
31
- msg.server_path = Contrast::Utils::StringUtils.protobuf_format(path)
32
- msg.server_type = Contrast::Utils::StringUtils.protobuf_format(type)
33
- config!(msg)
34
- msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::ASSESS.tags)
35
- msg
36
- end
37
-
38
- private
39
-
40
- # set the configuration driven values for this AgentStartup msg
41
- #
42
- # @param msg [Contrast::Api::Dtm::AgentStartup]
43
- def config! msg
44
- msg.version = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.version)
45
- msg.server_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.tags)
46
- msg.library_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.inventory.tags)
47
- msg.environment = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.server.environment)
48
- msg.application_tags = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.tags)
49
- end
50
- end
51
- end
52
- end
53
- end
54
- end
55
-
56
- Contrast::Api::Dtm::AgentStartup.include(Contrast::Api::Decorators::AgentStartup)
@@ -1,43 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Settings::ApplicationSettings}
10
- # protobuf model to handle setting translation.
11
- module ApplicationSettings
12
- MODE_ALLOWLIST = [
13
- Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,
14
- Contrast::Api::Settings::ProtectionRule::Mode::BLOCK,
15
- Contrast::Api::Settings::ProtectionRule::Mode::MONITOR,
16
- Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
17
- ].cs__freeze
18
- # Convert protobuf exlcusions into Agent exclusions
19
- def translated_exclusions
20
- exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
21
- end
22
-
23
- # Convert protobuf protect rule settings into a hash that settings state understands
24
- def translated_protection_mode_by_id
25
- protection_rules = self.protection_rules.map { |pr, _hash| [pr.id, pr.mode] } # [[RULE_ID, MODE]]
26
- protection_rules.select! { |(_id, mode)| MODE_ALLOWLIST.include?(mode) } # [REMOVE IF MODE INVALID]
27
- protection_rules.to_h # {RULE_ID => MODE}
28
- end
29
-
30
- def application_state_translation
31
- {
32
- modes_by_id: translated_protection_mode_by_id,
33
- exclusion_matchers: translated_exclusions,
34
- disabled_assess_rules: disabled_assess_rules,
35
- session_id: session_id
36
- }
37
- end
38
- end
39
- end
40
- end
41
- end
42
-
43
- Contrast::Api::Settings::ApplicationSettings.include(Contrast::Api::Decorators::ApplicationSettings)
@@ -1,56 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/api/decorators/instrumentation_mode'
6
- require 'contrast/components/base'
7
- require 'contrast/utils/string_utils'
8
-
9
- module Contrast
10
- module Api
11
- module Decorators
12
- # Used to decorate the ApplicationCreate protobuf model to handle reporting Agent process start
13
- module ApplicationStartup
14
- include Contrast::Components::ComponentBase
15
-
16
- def self.included klass
17
- klass.extend(ClassMethods)
18
- end
19
-
20
- # Used to add class methods to the AgentStartup class on inclusion of the decorator
21
- module ClassMethods
22
- # Return a new DTM with the values from the configuration
23
- #
24
- # @return [Contrast::Api::Dtm::ApplicationCreate]
25
- def build
26
- msg = new
27
- msg.code = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.code)
28
- msg.group = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.group)
29
- msg.metadata = Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.metadata)
30
- msg.mode = Contrast::Api::Dtm::InstrumentationMode.build
31
- msg.app_version =
32
- Contrast::Utils::StringUtils.protobuf_format(::Contrast::CONFIG.application.version.to_s) # rubocop:disable Layout/AssignmentIndentation Layout/FirstArgumentIndentation:
33
- session!(msg)
34
- msg
35
- end
36
-
37
- private
38
-
39
- # Set the session metadata for this ApplicationCreate msg
40
- #
41
- # @param msg [Contrast::Api::Dtm::ApplicationCreate]
42
- def session! msg
43
- msg.session_id = Contrast::Utils::StringUtils.protobuf_format(
44
- ::Contrast::CONFIG.application.session_id,
45
- truncate: false)
46
- msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format(
47
- ::Contrast::CONFIG.application.session_metadata,
48
- truncate: false)
49
- end
50
- end
51
- end
52
- end
53
- end
54
- end
55
-
56
- Contrast::Api::Dtm::ApplicationCreate.include(Contrast::Api::Decorators::ApplicationStartup)
@@ -1,37 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/utils/string_utils'
6
- require 'contrast/components/base'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the {Contrast::Api::Dtm::BotBlockerDetails} protobuf
12
- # model so it can own the request which its data is for.
13
- module BotBlockerDetails
14
- def self.included klass
15
- klass.extend(ClassMethods)
16
- end
17
-
18
- # Used to add class methods to the AgentStartup class on inclusion of the decorator
19
- module ClassMethods
20
- def build
21
- new
22
- end
23
-
24
- # @param result [Contrast::Api::Dtm::BotBlockerDetails]
25
- def to_controlled_hash result
26
- {
27
- bot: result.bot,
28
- user_agent: result.user_agent
29
- }
30
- end
31
- end
32
- end
33
- end
34
- end
35
- end
36
-
37
- Contrast::Api::Dtm::BotBlockerDetails.include(Contrast::Api::Decorators::BotBlockerDetails)
@@ -1,137 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/api/decorators/address'
6
- require 'contrast/components/scope'
7
- require 'contrast/utils/string_utils'
8
- require 'contrast/utils/timer'
9
-
10
- module Contrast
11
- module Api
12
- module Decorators
13
- # Used to decorate the {Contrast::Api::Dtm::HttpRequest} protobuf model
14
- # so it can own some of the data massaging required for Request dtm. Only
15
- # works as an extension of that class.
16
- module HttpRequest
17
- OMITTED_BODY = '{{body-omitted-by-contrast}}'
18
-
19
- def self.included klass
20
- klass.extend(ClassMethods)
21
- end
22
-
23
- # Append the sender and receiver to self.
24
- #
25
- # @param request [Contrast::Agent::Request]
26
- def append_addresses request
27
- self.sender = Contrast::Api::Dtm::Address.build_sender(request)
28
- self.receiver = Contrast::Api::Dtm::Address.build_receiver
29
- end
30
-
31
- # Append the connection to self.
32
- #
33
- # @param request [Contrast::Agent::Request]
34
- def append_connection request
35
- self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
36
- self.version = Contrast::Utils::StringUtils.force_utf8(request.version)
37
- self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
38
- self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
39
- self.uri = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
40
- end
41
-
42
- # Append the parameters to self, using the preferred
43
- # normalized_request_params field.
44
- #
45
- # @param request [Contrast::Agent::Request]
46
- def append_params request
47
- request.parameters.each do |k, v|
48
- append_pair(normalized_request_params, k, v)
49
- end
50
- end
51
-
52
- # Append the normalized headers to self, using the preferred
53
- # request_headers field.
54
- #
55
- # @param request [Contrast::Agent::Request]
56
- def append_headers request
57
- request.headers.each do |k, v|
58
- next unless k && v
59
- next if v.is_a?(Hash)
60
-
61
- key = Contrast::Utils::StringUtils.force_utf8(k)
62
- val = Contrast::Utils::StringUtils.force_utf8(v)
63
- request_headers[key] = val
64
- end
65
-
66
- request.cookies.each do |k, v|
67
- append_pair(normalized_cookies, k, v)
68
- end
69
- end
70
-
71
- # Append the body to self, using the preferred
72
- # request_body_binary field.
73
- #
74
- # @param request [Contrast::Agent::Request]
75
- def append_body request
76
- self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
77
-
78
- self.request_body_binary = if omit_body?(request)
79
- OMITTED_BODY
80
- else
81
- Contrast::Utils::StringUtils.force_utf8(request.body)
82
- end
83
- return if request.file_names.empty?
84
-
85
- request.file_names.each do |name, filename|
86
- pair = Contrast::Api::Dtm::SimplePair.new
87
- pair.key = Contrast::Utils::StringUtils.force_utf8(name)
88
- pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
89
- multipart_headers << pair
90
- end
91
- end
92
-
93
- def omit_body? request
94
- return true if ::Contrast::AGENT.omit_body?
95
- return false if request.document_type != :NORMAL
96
-
97
- request.media_type&.include?('multipart/form-data')
98
- end
99
-
100
- def append_pair map, key, value
101
- return unless key && value
102
- return if value.is_a?(Hash)
103
-
104
- safe_key = Contrast::Utils::StringUtils.force_utf8(key)
105
- map[safe_key] ||= Contrast::Api::Dtm::Pair.new
106
- map[safe_key].key = safe_key
107
- map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
108
- end
109
-
110
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
111
- module ClassMethods
112
- include Contrast::Components::Scope::InstanceMethods
113
-
114
- # Convert our Request into a DTM
115
- # @param request [Contrast::Agent::Request]
116
- # @return [Contrast::Api::Dtm::HttpRequest]
117
- def build request
118
- with_contrast_scope do
119
- msg = new
120
- msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
121
- msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
122
-
123
- msg.append_addresses(request)
124
- msg.append_connection(request)
125
- msg.append_params(request)
126
- msg.append_headers(request)
127
- msg.append_body(request)
128
- msg
129
- end
130
- end
131
- end
132
- end
133
- end
134
- end
135
- end
136
-
137
- Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)
@@ -1,18 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Settings::InputAnalysis} protobuf
10
- # model so it can own the request which its data is for.
11
- module InputAnalysis
12
- attr_accessor :request
13
- end
14
- end
15
- end
16
- end
17
-
18
- Contrast::Api::Settings::InputAnalysis.include(Contrast::Api::Decorators::InputAnalysis)
@@ -1,35 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/components/base'
6
-
7
- module Contrast
8
- module Api
9
- module Decorators
10
- # Used to decorate the InstrumentationMode protobuf model to handle reporting Agent process start
11
- module InstrumentationMode
12
- include Contrast::Components::ComponentBase
13
-
14
- def self.included klass
15
- klass.extend(ClassMethods)
16
- end
17
-
18
- # Used to add class methods to the AgentStartup class on inclusion of the decorator
19
- module ClassMethods
20
- # Return a new DTM with the values from the configuration
21
- #
22
- # @return [Contrast::Api::Dtm::InstrumentationMode]
23
- def build
24
- msg = new
25
- msg.assess = ::Contrast::ASSESS.enabled?
26
- msg.protect = ::Contrast::PROTECT.enabled?
27
- msg
28
- end
29
- end
30
- end
31
- end
32
- end
33
- end
34
-
35
- Contrast::Api::Dtm::InstrumentationMode.include(Contrast::Api::Decorators::InstrumentationMode)
@@ -1,37 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'contrast/utils/string_utils'
6
- require 'contrast/components/base'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the {Contrast::Api::Dtm::IpDenylistDetails} protobuf
12
- # model so it can own the request which its data is for.
13
- module IpDenylistDetails
14
- def self.included klass
15
- klass.extend(ClassMethods)
16
- end
17
-
18
- # Used to add class methods to the AgentStartup class on inclusion of the decorator
19
- module ClassMethods
20
- def build
21
- new
22
- end
23
-
24
- # @param result [Contrast::Api::Dtm::IpDenylistDetails]
25
- def to_controlled_hash result
26
- {
27
- ip: result.ip,
28
- uuid: result.uuid
29
- }
30
- end
31
- end
32
- end
33
- end
34
- end
35
- end
36
-
37
- Contrast::Api::Dtm::IpDenylistDetails.include(Contrast::Api::Decorators::IpDenylistDetails)
@@ -1,67 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/object_share'
5
- require 'contrast/utils/string_utils'
6
- require 'contrast/components/logger'
7
-
8
- module Contrast
9
- module Api
10
- module Decorators
11
- # Used to decorate the {Contrast::Api::Dtm::Message} protobuf model so it
12
- # can handle instance data massaging.
13
- module Message
14
- include Contrast::Components::Logger::InstanceMethods
15
-
16
- def self.included klass
17
- klass.extend(ClassMethods)
18
- end
19
-
20
- def append_event event
21
- case event
22
- when Contrast::Api::Dtm::AgentStartup
23
- self.agent_startup = event
24
- when Contrast::Api::Dtm::ApplicationCreate
25
- self.application_create = event
26
- when Contrast::Api::Dtm::HttpRequest
27
- self.prefilter = event
28
- when Contrast::Api::Dtm::Poll
29
- self.poll = event
30
- else
31
- logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.cs__name)
32
- return
33
- end
34
- logger.debug('Wrapping event in message',
35
- msg_id: __id__,
36
- p_id: pid,
37
- msg_count: message_count,
38
- event_id: event.__id__,
39
- event_type: event.cs__class.cs__name)
40
- end
41
-
42
- # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
43
- module ClassMethods
44
- @@message_total = 0 # rubocop:disable Style/ClassVars
45
- def message_count
46
- @@message_total += 1 # rubocop:disable Style/ClassVars
47
- end
48
-
49
- def build event
50
- msg = new
51
- msg.app_name = ::Contrast::APP_CONTEXT.name # rubocop:disable Security/Module/Name
52
- msg.app_path = ::Contrast::APP_CONTEXT.path
53
- msg.app_language = Contrast::Utils::ObjectShare::RUBY
54
- msg.client_id = ::Contrast::APP_CONTEXT.client_id
55
- msg.message_count = message_count
56
- msg.pid = ::Contrast::APP_CONTEXT.pid
57
- msg.ppid = ::Contrast::APP_CONTEXT.ppid
58
- msg.append_event(event)
59
- msg
60
- end
61
- end
62
- end
63
- end
64
- end
65
- end
66
-
67
- Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)
@@ -1,52 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Api
6
- module Decorators
7
- # Used to decorate the {Contrast::Api::Dtm::RaspRuleSample} protobuf
8
- # model.
9
- module RaspRuleSample
10
- def self.included klass
11
- klass.extend(ClassMethods)
12
- end
13
-
14
- # Used to add class methods to RaspRuleSample
15
- module ClassMethods
16
- def build context, ia_result
17
- sample = new
18
- sample.timestamp_ms = context.timer.start_ms
19
- sample.user_input = Contrast::Api::Dtm::UserInput.build_from_ia_result(ia_result)
20
- sample.user_input.document_type = Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
21
- sample
22
- end
23
-
24
- # @param result [Contrast::Api::Dtm::RaspRuleSample]
25
- def to_controlled_hash result
26
- {
27
- timestamp: Time.at(result.timestamp_ms).iso8601,
28
- user_input: result.user_input,
29
- bot_blocker: result.bot_blocker,
30
- cmdi: result.cmdi,
31
- untrusted_deserialization: result.untrusted_deserialization,
32
- padding_oracle: result.padding_oracle,
33
- path_traversal: result.path_traversal,
34
- re_dos: result.re_dos,
35
- sqli: result.sqli,
36
- ssrf: result.ssrf,
37
- virtual_patch: result.virtual_patch,
38
- xss: result.xss,
39
- xxe: result.xxe,
40
- no_sqli: result.no_sqli,
41
- method_tampering: result.method_tampering,
42
- path_traversal_semantic: result.path_traversal_semantic,
43
- ip_denylist: result.ip_denylist
44
- }
45
- end
46
- end
47
- end
48
- end
49
- end
50
- end
51
-
52
- Contrast::Api::Dtm::RaspRuleSample.include(Contrast::Api::Decorators::RaspRuleSample)
@@ -1,17 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/api/dtm.pb'
5
- require 'protobuf/message'
6
-
7
- module Contrast
8
- module Api
9
- module Dtm
10
- class AttackResult < ::Protobuf::Message
11
- class ResponseType < ::Protobuf::Enum
12
- define :SUSPICIOUS, 6
13
- end
14
- end
15
- end
16
- end
17
- end
@@ -1,25 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/utils/string_utils'
5
-
6
- module Contrast
7
- module Api
8
- module Decorators
9
- # Used to decorate the {Contrast::Api::Settings::ServerFeatures} protobuf
10
- # model to handle setting translation to boolean values.
11
- module ServerFeatures
12
- # 'defend' is legacy for 'protect' in the dtm.
13
- def protect_enabled?
14
- !!defend.enabled
15
- end
16
-
17
- def assess_enabled?
18
- !!assess.enabled
19
- end
20
- end
21
- end
22
- end
23
- end
24
-
25
- Contrast::Api::Settings::ServerFeatures.include(Contrast::Api::Decorators::ServerFeatures)