contrast-agent 6.7.0 → 6.9.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (280) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +0 -2
  3. data/.simplecov +0 -1
  4. data/Rakefile +0 -1
  5. data/ext/cs__assess_array/cs__assess_array.c +41 -10
  6. data/ext/cs__assess_array/cs__assess_array.h +4 -1
  7. data/lib/contrast/agent/assess/policy/trigger_method.rb +3 -3
  8. data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb +1 -1
  9. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +1 -1
  10. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +1 -1
  11. data/lib/contrast/agent/assess/property/evented.rb +11 -11
  12. data/lib/contrast/agent/assess.rb +0 -1
  13. data/lib/contrast/agent/excluder.rb +53 -35
  14. data/lib/contrast/agent/exclusion_matcher.rb +21 -9
  15. data/lib/contrast/agent/middleware.rb +12 -6
  16. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +6 -0
  17. data/lib/contrast/agent/protect/input_analyzer/input_analyzer.rb +146 -127
  18. data/lib/contrast/agent/protect/input_analyzer/worth_watching_analyzer.rb +116 -0
  19. data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +20 -0
  20. data/lib/contrast/agent/protect/policy/rule_applicator.rb +1 -1
  21. data/lib/contrast/agent/protect/rule/base.rb +47 -55
  22. data/lib/contrast/agent/protect/rule/base_service.rb +48 -24
  23. data/lib/contrast/agent/protect/rule/bot_blocker/bot_blocker_input_classification.rb +98 -0
  24. data/lib/contrast/agent/protect/rule/bot_blocker.rb +81 -0
  25. data/lib/contrast/agent/protect/rule/cmd_injection.rb +20 -2
  26. data/lib/contrast/agent/protect/rule/cmdi/cmdi_backdoors.rb +8 -5
  27. data/lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb +22 -22
  28. data/lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb +64 -0
  29. data/lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb +63 -0
  30. data/lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb +2 -58
  31. data/lib/contrast/agent/protect/rule/default_scanner.rb +1 -1
  32. data/lib/contrast/agent/protect/rule/deserialization.rb +3 -14
  33. data/lib/contrast/agent/protect/rule/http_method_tampering/http_method_tampering_input_classification.rb +2 -2
  34. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +0 -11
  35. data/lib/contrast/agent/protect/rule/no_sqli/no_sqli_input_classification.rb +29 -34
  36. data/lib/contrast/agent/protect/rule/no_sqli.rb +25 -18
  37. data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_input_classification.rb +61 -0
  38. data/lib/contrast/agent/protect/rule/path_traversal/path_traversal_semantic_security_bypass.rb +114 -0
  39. data/lib/contrast/agent/protect/rule/path_traversal.rb +40 -13
  40. data/lib/contrast/agent/protect/rule/sql_sample_builder.rb +33 -15
  41. data/lib/contrast/agent/protect/rule/sqli/sqli_base_rule.rb +0 -14
  42. data/lib/contrast/agent/protect/rule/sqli/sqli_input_classification.rb +2 -62
  43. data/lib/contrast/agent/protect/rule/sqli.rb +74 -3
  44. data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_input_classification.rb +39 -63
  45. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +6 -33
  46. data/lib/contrast/agent/protect/rule/xss/reflected_xss_input_classification.rb +58 -0
  47. data/lib/contrast/agent/protect/rule/xss.rb +15 -20
  48. data/lib/contrast/agent/protect/rule/xxe.rb +4 -24
  49. data/lib/contrast/agent/reporting/attack_result/rasp_rule_sample.rb +19 -40
  50. data/lib/contrast/agent/reporting/attack_result/response_type.rb +9 -9
  51. data/lib/contrast/agent/reporting/details/ip_denylist_details.rb +10 -2
  52. data/lib/contrast/agent/reporting/details/virtual_patch_details.rb +8 -2
  53. data/lib/contrast/agent/reporting/input_analysis/details/bot_blocker_details.rb +27 -0
  54. data/lib/contrast/agent/reporting/input_analysis/details/protect_rule_details.rb +15 -0
  55. data/lib/contrast/agent/reporting/input_analysis/input_analysis.rb +1 -2
  56. data/lib/contrast/agent/reporting/input_analysis/input_analysis_result.rb +16 -2
  57. data/lib/contrast/agent/reporting/masker/masker.rb +2 -0
  58. data/lib/contrast/agent/reporting/report.rb +1 -0
  59. data/lib/contrast/agent/reporting/reporter.rb +35 -14
  60. data/lib/contrast/agent/reporting/reporter_heartbeat.rb +3 -9
  61. data/lib/contrast/agent/reporting/reporting_events/application_activity.rb +16 -13
  62. data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb +12 -7
  63. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb +3 -3
  64. data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb +1 -2
  65. data/lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb +6 -1
  66. data/lib/contrast/agent/reporting/reporting_events/application_update.rb +0 -2
  67. data/lib/contrast/agent/reporting/reporting_events/architecture_component.rb +0 -1
  68. data/lib/contrast/agent/reporting/reporting_events/finding.rb +6 -6
  69. data/lib/contrast/agent/reporting/reporting_events/finding_event.rb +239 -93
  70. data/lib/contrast/agent/reporting/reporting_events/finding_event_signature.rb +10 -23
  71. data/lib/contrast/agent/reporting/reporting_events/finding_event_source.rb +10 -9
  72. data/lib/contrast/agent/reporting/reporting_events/finding_request.rb +0 -5
  73. data/lib/contrast/agent/reporting/reporting_events/library_discovery.rb +0 -1
  74. data/lib/contrast/agent/reporting/reporting_events/observed_route.rb +12 -0
  75. data/lib/contrast/agent/reporting/reporting_events/poll.rb +1 -11
  76. data/lib/contrast/agent/reporting/reporting_events/route_discovery.rb +0 -1
  77. data/lib/contrast/agent/reporting/reporting_events/route_discovery_observation.rb +0 -1
  78. data/lib/contrast/agent/reporting/reporting_events/server_reporting_event.rb +8 -0
  79. data/lib/contrast/agent/reporting/reporting_events/server_settings.rb +40 -0
  80. data/lib/contrast/agent/reporting/reporting_utilities/audit.rb +2 -2
  81. data/lib/contrast/agent/reporting/reporting_utilities/endpoints.rb +6 -0
  82. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client.rb +43 -1
  83. data/lib/contrast/agent/reporting/reporting_utilities/reporter_client_utils.rb +8 -4
  84. data/lib/contrast/agent/reporting/reporting_utilities/response.rb +1 -1
  85. data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb +58 -4
  86. data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb +4 -6
  87. data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb +77 -16
  88. data/lib/contrast/agent/reporting/server_settings_worker.rb +44 -0
  89. data/lib/contrast/agent/reporting/settings/assess_server_feature.rb +14 -2
  90. data/lib/contrast/agent/reporting/settings/code_exclusion.rb +6 -1
  91. data/lib/contrast/agent/reporting/settings/exclusion_base.rb +18 -0
  92. data/lib/contrast/agent/reporting/settings/exclusions.rb +2 -1
  93. data/lib/contrast/agent/reporting/settings/helpers.rb +7 -0
  94. data/lib/contrast/agent/reporting/settings/input_exclusion.rb +9 -3
  95. data/lib/contrast/agent/reporting/settings/protect.rb +15 -15
  96. data/lib/contrast/agent/reporting/settings/protect_server_feature.rb +39 -2
  97. data/lib/contrast/agent/reporting/settings/rule_definition.rb +3 -0
  98. data/lib/contrast/agent/reporting/settings/security_logger.rb +77 -0
  99. data/lib/contrast/agent/reporting/settings/server_features.rb +9 -0
  100. data/lib/contrast/agent/reporting/settings/syslog.rb +34 -5
  101. data/lib/contrast/agent/request.rb +3 -14
  102. data/lib/contrast/agent/request_context.rb +6 -9
  103. data/lib/contrast/agent/request_context_extend.rb +9 -148
  104. data/lib/contrast/agent/request_handler.rb +5 -10
  105. data/lib/contrast/agent/telemetry/events/exceptions/telemetry_exception_event.rb +1 -1
  106. data/lib/contrast/agent/thread_watcher.rb +37 -18
  107. data/lib/contrast/agent/version.rb +1 -1
  108. data/lib/contrast/agent.rb +6 -11
  109. data/lib/contrast/agent_lib/api/command_injection.rb +46 -0
  110. data/lib/contrast/agent_lib/api/init.rb +101 -0
  111. data/lib/contrast/agent_lib/api/input_tracing.rb +267 -0
  112. data/lib/contrast/agent_lib/api/method_tempering.rb +29 -0
  113. data/lib/contrast/agent_lib/api/panic.rb +87 -0
  114. data/lib/contrast/agent_lib/api/path_semantic_file_security_bypass.rb +40 -0
  115. data/lib/contrast/agent_lib/interface.rb +260 -0
  116. data/lib/contrast/agent_lib/interface_base.rb +118 -0
  117. data/lib/contrast/agent_lib/return_types/eval_result.rb +44 -0
  118. data/lib/contrast/agent_lib/test.rb +29 -0
  119. data/lib/contrast/api/communication/connection_status.rb +20 -5
  120. data/lib/contrast/components/agent.rb +34 -14
  121. data/lib/contrast/components/api.rb +23 -0
  122. data/lib/contrast/components/app_context.rb +23 -5
  123. data/lib/contrast/components/app_context_extend.rb +0 -25
  124. data/lib/contrast/components/assess.rb +34 -4
  125. data/lib/contrast/components/assess_rules.rb +18 -0
  126. data/lib/contrast/components/base.rb +40 -0
  127. data/lib/contrast/components/config/sources.rb +95 -0
  128. data/lib/contrast/components/config.rb +19 -19
  129. data/lib/contrast/components/heap_dump.rb +10 -0
  130. data/lib/contrast/components/inventory.rb +15 -2
  131. data/lib/contrast/components/logger.rb +18 -0
  132. data/lib/contrast/components/polling.rb +36 -0
  133. data/lib/contrast/components/protect.rb +52 -2
  134. data/lib/contrast/components/ruby_component.rb +16 -1
  135. data/lib/contrast/components/sampling.rb +70 -13
  136. data/lib/contrast/components/security_logger.rb +13 -0
  137. data/lib/contrast/components/settings.rb +105 -90
  138. data/lib/contrast/config/certification_configuration.rb +14 -0
  139. data/lib/contrast/config/config.rb +46 -0
  140. data/lib/contrast/config/diagnostics.rb +114 -0
  141. data/lib/contrast/config/diagnostics_tools.rb +98 -0
  142. data/lib/contrast/config/effective_config.rb +65 -0
  143. data/lib/contrast/config/effective_config_value.rb +32 -0
  144. data/lib/contrast/config/exception_configuration.rb +12 -0
  145. data/lib/contrast/config/protect_rule_configuration.rb +8 -8
  146. data/lib/contrast/config/protect_rules_configuration.rb +23 -60
  147. data/lib/contrast/config/request_audit_configuration.rb +13 -0
  148. data/lib/contrast/config/server_configuration.rb +41 -2
  149. data/lib/contrast/configuration.rb +29 -12
  150. data/lib/contrast/extension/assess/array.rb +9 -0
  151. data/lib/contrast/extension/assess/erb.rb +1 -1
  152. data/lib/contrast/extension/delegator.rb +2 -0
  153. data/lib/contrast/framework/manager.rb +3 -1
  154. data/lib/contrast/framework/rails/railtie.rb +0 -1
  155. data/lib/contrast/framework/rails/support.rb +0 -1
  156. data/lib/contrast/tasks/config.rb +1 -8
  157. data/lib/contrast/utils/assess/event_limit_utils.rb +31 -9
  158. data/lib/contrast/utils/assess/trigger_method_utils.rb +5 -4
  159. data/lib/contrast/utils/duck_utils.rb +1 -0
  160. data/lib/contrast/utils/hash_digest.rb +2 -2
  161. data/lib/contrast/utils/input_classification_base.rb +155 -0
  162. data/lib/contrast/utils/os.rb +0 -20
  163. data/lib/contrast/utils/reporting/application_activity_batch_utils.rb +81 -0
  164. data/lib/contrast/utils/response_utils.rb +0 -16
  165. data/lib/contrast/utils/routes_sent.rb +60 -0
  166. data/lib/contrast/utils/stack_trace_utils.rb +3 -15
  167. data/lib/contrast/utils/string_utils.rb +10 -7
  168. data/lib/contrast/utils/telemetry_client.rb +1 -2
  169. data/lib/contrast/utils/timer.rb +16 -0
  170. data/lib/contrast.rb +5 -4
  171. data/resources/protect/policy.json +1 -2
  172. data/ruby-agent.gemspec +7 -6
  173. metadata +69 -130
  174. data/exe/contrast_service +0 -23
  175. data/lib/contrast/agent/assess/contrast_event.rb +0 -157
  176. data/lib/contrast/agent/assess/events/event_factory.rb +0 -34
  177. data/lib/contrast/agent/assess/events/source_event.rb +0 -46
  178. data/lib/contrast/agent/protect/rule/cmdi/cmdi_worth_watching.rb +0 -64
  179. data/lib/contrast/agent/protect/rule/sqli/sqli_worth_watching.rb +0 -118
  180. data/lib/contrast/agent/protect/rule/unsafe_file_upload/unsafe_file_upload_matcher.rb +0 -45
  181. data/lib/contrast/agent/reaction_processor.rb +0 -47
  182. data/lib/contrast/agent/reporting/reporting_events/server_activity.rb +0 -36
  183. data/lib/contrast/agent/service_heartbeat.rb +0 -35
  184. data/lib/contrast/api/communication/messaging_queue.rb +0 -128
  185. data/lib/contrast/api/communication/response_processor.rb +0 -90
  186. data/lib/contrast/api/communication/service_lifecycle.rb +0 -77
  187. data/lib/contrast/api/communication/socket.rb +0 -44
  188. data/lib/contrast/api/communication/socket_client.rb +0 -130
  189. data/lib/contrast/api/communication/speedracer.rb +0 -138
  190. data/lib/contrast/api/communication/tcp_socket.rb +0 -32
  191. data/lib/contrast/api/communication/unix_socket.rb +0 -28
  192. data/lib/contrast/api/communication.rb +0 -20
  193. data/lib/contrast/api/decorators/address.rb +0 -59
  194. data/lib/contrast/api/decorators/agent_startup.rb +0 -56
  195. data/lib/contrast/api/decorators/application_settings.rb +0 -43
  196. data/lib/contrast/api/decorators/application_startup.rb +0 -56
  197. data/lib/contrast/api/decorators/bot_blocker.rb +0 -37
  198. data/lib/contrast/api/decorators/http_request.rb +0 -137
  199. data/lib/contrast/api/decorators/input_analysis.rb +0 -18
  200. data/lib/contrast/api/decorators/instrumentation_mode.rb +0 -35
  201. data/lib/contrast/api/decorators/ip_denylist.rb +0 -37
  202. data/lib/contrast/api/decorators/message.rb +0 -67
  203. data/lib/contrast/api/decorators/rasp_rule_sample.rb +0 -52
  204. data/lib/contrast/api/decorators/response_type.rb +0 -17
  205. data/lib/contrast/api/decorators/server_features.rb +0 -25
  206. data/lib/contrast/api/decorators/user_input.rb +0 -51
  207. data/lib/contrast/api/decorators/virtual_patch.rb +0 -34
  208. data/lib/contrast/api/decorators.rb +0 -22
  209. data/lib/contrast/api/dtm.pb.rb +0 -363
  210. data/lib/contrast/api/settings.pb.rb +0 -500
  211. data/lib/contrast/api.rb +0 -16
  212. data/lib/contrast/components/contrast_service.rb +0 -88
  213. data/lib/contrast/components/service.rb +0 -55
  214. data/lib/contrast/tasks/service.rb +0 -84
  215. data/lib/contrast/utils/input_classification.rb +0 -73
  216. data/lib/protobuf/code_generator.rb +0 -129
  217. data/lib/protobuf/decoder.rb +0 -28
  218. data/lib/protobuf/deprecation.rb +0 -117
  219. data/lib/protobuf/descriptors/google/protobuf/compiler/plugin.pb.rb +0 -79
  220. data/lib/protobuf/descriptors/google/protobuf/descriptor.pb.rb +0 -360
  221. data/lib/protobuf/descriptors.rb +0 -3
  222. data/lib/protobuf/encoder.rb +0 -11
  223. data/lib/protobuf/enum.rb +0 -365
  224. data/lib/protobuf/exceptions.rb +0 -9
  225. data/lib/protobuf/field/base_field.rb +0 -380
  226. data/lib/protobuf/field/base_field_object_definitions.rb +0 -504
  227. data/lib/protobuf/field/bool_field.rb +0 -64
  228. data/lib/protobuf/field/bytes_field.rb +0 -67
  229. data/lib/protobuf/field/double_field.rb +0 -25
  230. data/lib/protobuf/field/enum_field.rb +0 -56
  231. data/lib/protobuf/field/field_array.rb +0 -102
  232. data/lib/protobuf/field/field_hash.rb +0 -122
  233. data/lib/protobuf/field/fixed32_field.rb +0 -25
  234. data/lib/protobuf/field/fixed64_field.rb +0 -28
  235. data/lib/protobuf/field/float_field.rb +0 -43
  236. data/lib/protobuf/field/int32_field.rb +0 -21
  237. data/lib/protobuf/field/int64_field.rb +0 -34
  238. data/lib/protobuf/field/integer_field.rb +0 -23
  239. data/lib/protobuf/field/message_field.rb +0 -51
  240. data/lib/protobuf/field/sfixed32_field.rb +0 -27
  241. data/lib/protobuf/field/sfixed64_field.rb +0 -28
  242. data/lib/protobuf/field/signed_integer_field.rb +0 -29
  243. data/lib/protobuf/field/sint32_field.rb +0 -21
  244. data/lib/protobuf/field/sint64_field.rb +0 -21
  245. data/lib/protobuf/field/string_field.rb +0 -51
  246. data/lib/protobuf/field/uint32_field.rb +0 -21
  247. data/lib/protobuf/field/uint64_field.rb +0 -21
  248. data/lib/protobuf/field/varint_field.rb +0 -77
  249. data/lib/protobuf/field.rb +0 -74
  250. data/lib/protobuf/generators/base.rb +0 -85
  251. data/lib/protobuf/generators/enum_generator.rb +0 -39
  252. data/lib/protobuf/generators/extension_generator.rb +0 -27
  253. data/lib/protobuf/generators/field_generator.rb +0 -193
  254. data/lib/protobuf/generators/file_generator.rb +0 -262
  255. data/lib/protobuf/generators/group_generator.rb +0 -122
  256. data/lib/protobuf/generators/message_generator.rb +0 -104
  257. data/lib/protobuf/generators/option_generator.rb +0 -17
  258. data/lib/protobuf/generators/printable.rb +0 -160
  259. data/lib/protobuf/generators/service_generator.rb +0 -50
  260. data/lib/protobuf/lifecycle.rb +0 -33
  261. data/lib/protobuf/logging.rb +0 -39
  262. data/lib/protobuf/message/fields.rb +0 -233
  263. data/lib/protobuf/message/serialization.rb +0 -85
  264. data/lib/protobuf/message.rb +0 -241
  265. data/lib/protobuf/optionable.rb +0 -72
  266. data/lib/protobuf/tasks/compile.rake +0 -80
  267. data/lib/protobuf/tasks.rb +0 -1
  268. data/lib/protobuf/varint.rb +0 -20
  269. data/lib/protobuf/varint_pure.rb +0 -31
  270. data/lib/protobuf/version.rb +0 -3
  271. data/lib/protobuf/wire_type.rb +0 -10
  272. data/lib/protobuf.rb +0 -91
  273. data/proto/dynamic_discovery.proto +0 -46
  274. data/proto/google/protobuf/compiler/plugin.proto +0 -183
  275. data/proto/google/protobuf/descriptor.proto +0 -911
  276. data/proto/rpc.proto +0 -71
  277. data/service_executables/.gitkeep +0 -0
  278. data/service_executables/VERSION +0 -1
  279. data/service_executables/linux/contrast-service +0 -0
  280. data/service_executables/mac/contrast-service +0 -0
@@ -1,500 +0,0 @@
1
- # encoding: utf-8
2
-
3
- ##
4
- # This file is auto-generated. DO NOT EDIT!
5
- #
6
- require 'protobuf'
7
-
8
- module Contrast
9
- module Api
10
- module Settings
11
- ::Protobuf::Optionable.inject(self) { ::CSGoogle::Protobuf::FileOptions }
12
-
13
- ##
14
- # Enum Classes
15
- #
16
- class LogLevel < ::Protobuf::Enum
17
- define :TRACE, 0
18
- define :DEBUG, 1
19
- define :INFO, 2
20
- define :WARN, 3
21
- define :ERROR, 4
22
- end
23
-
24
-
25
- ##
26
- # Message Classes
27
- #
28
- class ApplicationState < ::Protobuf::Message; end
29
- class AgentSettings < ::Protobuf::Message; end
30
- class ProtectState < ::Protobuf::Message; end
31
- class ServerFeatures < ::Protobuf::Message
32
- class InstrumentationMode < ::Protobuf::Enum
33
- define :UNDEFINED, 0
34
- define :AGENT_CONFIG, 1
35
- define :DUPLEX, 2
36
- define :PROFILER, 3
37
- end
38
-
39
- end
40
-
41
- class ContrastServiceData < ::Protobuf::Message; end
42
- class ApplicationSettings < ::Protobuf::Message; end
43
- class SqlInjectionSettings < ::Protobuf::Message; end
44
- class Reaction < ::Protobuf::Message
45
- class Operation < ::Protobuf::Enum
46
- define :NOOP, 0
47
- define :DISABLE, 1
48
- define :INVENTORY, 2
49
- end
50
-
51
- end
52
-
53
- class AccumulatorSettings < ::Protobuf::Message
54
- end
55
-
56
- class InventoryFeatures < ::Protobuf::Message; end
57
- class AssessFeatures < ::Protobuf::Message
58
- class SaveStacktrace < ::Protobuf::Enum
59
- define :UNDEFINED, 0
60
- define :ALL, 1
61
- define :SOME, 2
62
- define :NONE, 3
63
- end
64
-
65
- end
66
-
67
- class CustomRuleFeature < ::Protobuf::Message; end
68
- class Sampling < ::Protobuf::Message; end
69
- class DynamicSource < ::Protobuf::Message
70
- end
71
-
72
- class DefendFeatures < ::Protobuf::Message; end
73
- class Syslog < ::Protobuf::Message
74
- class ConnectionType < ::Protobuf::Enum
75
- define :UNENCRYPTED, 0
76
- define :ENCRYOTED, 1
77
- define :ENCRYPTED, 2
78
- end
79
-
80
- class Severity < ::Protobuf::Enum
81
- define :UNDEFINED, 0
82
- define :ALERT, 1
83
- define :CRITICAL, 2
84
- define :ERROR, 3
85
- define :WARNING, 4
86
- define :NOTICE, 5
87
- define :INFO, 6
88
- define :DEBUG, 7
89
- end
90
-
91
- end
92
-
93
- class BotBlocker < ::Protobuf::Message; end
94
- class IpFilter < ::Protobuf::Message; end
95
- class LogEnhancer < ::Protobuf::Message
96
- class LogLevel < ::Protobuf::Enum
97
- define :TRACE, 0
98
- define :DEBUG, 1
99
- define :INFO, 2
100
- define :WARN, 3
101
- define :ERROR, 4
102
- end
103
-
104
- class LogType < ::Protobuf::Enum
105
- define :LOG_AUDIT, 0
106
- define :LOG_ERROR, 1
107
- define :LOG_SECURITY, 2
108
- end
109
-
110
- end
111
-
112
- class RuleDefinition < ::Protobuf::Message; end
113
- class StringDefinition < ::Protobuf::Message
114
- class Type < ::Protobuf::Enum
115
- define :KEYWORD, 0
116
- define :PATTERN, 1
117
- end
118
-
119
- end
120
-
121
- class Exclusion < ::Protobuf::Message
122
- class ExclusionType < ::Protobuf::Enum
123
- define :URL, 0
124
- define :INPUT, 1
125
- define :CODE, 2
126
- end
127
-
128
- class InputType < ::Protobuf::Enum
129
- define :UNDEFINED, 0
130
- define :COOKIE, 1
131
- define :PARAMETER, 2
132
- define :HEADER, 3
133
- define :BODY, 4
134
- define :QUERYSTRING, 5
135
- end
136
-
137
- class MatchStrategy < ::Protobuf::Enum
138
- define :ALL, 0
139
- define :ONLY, 1
140
- end
141
-
142
- end
143
-
144
- class VirtualPatch < ::Protobuf::Message; end
145
- class VirtualPatchCondition < ::Protobuf::Message
146
- class InputType < ::Protobuf::Enum
147
- define :UNKNOWN_INPUT, 0
148
- define :USERAGENT, 1
149
- define :REFERER, 2
150
- define :URL, 3
151
- define :PARAMETER, 4
152
- define :HEADER, 5
153
- define :CODE, 6
154
- end
155
-
156
- class Evaluation < ::Protobuf::Enum
157
- define :UNKNOWN_EVALUATION, 0
158
- define :MATCHES, 1
159
- define :DOESNT_MATCH, 2
160
- define :CONTAINS, 3
161
- define :DOESNT_CONTAIN, 4
162
- define :EQUALS, 5
163
- define :DOESNT_EQUAL, 6
164
- end
165
-
166
- end
167
-
168
- class ProtectionRule < ::Protobuf::Message
169
- class Mode < ::Protobuf::Enum
170
- define :NO_ACTION, 0
171
- define :MONITOR, 1
172
- define :BLOCK, 2
173
- define :BLOCK_AT_PERIMETER, 3
174
- define :PERMIT, 4
175
- end
176
-
177
- end
178
-
179
- class Accumulator < ::Protobuf::Message; end
180
- class Auth < ::Protobuf::Message
181
- class Mode < ::Protobuf::Enum
182
- define :OFF, 0
183
- define :MONITOR, 1
184
- end
185
-
186
- end
187
-
188
- class InputAnalysis < ::Protobuf::Message; end
189
- class InputAnalysisResult < ::Protobuf::Message
190
- class InputType < ::Protobuf::Enum
191
- define :UNDEFINED_TYPE, 0
192
- define :BODY, 1
193
- define :COOKIE_NAME, 2
194
- define :COOKIE_VALUE, 3
195
- define :HEADER, 4
196
- define :PARAMETER_NAME, 5
197
- define :PARAMETER_VALUE, 6
198
- define :QUERYSTRING, 7
199
- define :URI, 8
200
- define :SOCKET, 9
201
- define :JSON_VALUE, 10
202
- define :JSON_ARRAYED_VALUE, 11
203
- define :MULTIPART_CONTENT_TYPE, 16
204
- define :MULTIPART_VALUE, 17
205
- define :MULTIPART_FIELD_NAME, 18
206
- define :MULTIPART_NAME, 19
207
- define :XML_VALUE, 20
208
- define :DWR_VALUE, 21
209
- define :METHOD, 22
210
- define :REQUEST, 23
211
- define :URL_PARAMETER, 24
212
- define :UNKNOWN, 99
213
- end
214
-
215
- class ScoreLevel < ::Protobuf::Enum
216
- define :DONTCARE, 0
217
- define :WORTHWATCHING, 1
218
- define :DEFINITEATTACK, 2
219
- end
220
-
221
- end
222
-
223
-
224
-
225
- ##
226
- # File Options
227
- #
228
- set_option :go_package, "bitbucket.org/contrastsecurity/go-speedracer-go/from_service"
229
-
230
-
231
- ##
232
- # Message Fields
233
- #
234
- class ApplicationState
235
- optional :int64, :created_ms, 1
236
- optional :string, :app_name, 2
237
- optional :string, :app_language, 3
238
- optional :string, :app_path, 4
239
- optional :string, :app_group, 16
240
- optional :string, :app_tags, 17
241
- optional :string, :app_version, 18
242
- optional ::Contrast::Api::Settings::ServerFeatures, :server_features, 6
243
- optional ::Contrast::Api::Settings::ApplicationSettings, :application_settings, 7
244
- optional ::Contrast::Api::Settings::AccumulatorSettings, :accumulator_settings, 8
245
- optional :string, :server_name, 9
246
- optional :string, :server_path, 10
247
- optional :string, :server_type, 11
248
- optional :string, :server_tags, 13
249
- optional :string, :server_environment, 14
250
- optional :string, :server_version, 15
251
- optional :string, :agent_version, 12
252
- end
253
-
254
- class AgentSettings
255
- optional :int64, :sent_ms, 1
256
- optional ::Contrast::Api::Settings::ServerFeatures, :server_features, 2
257
- optional ::Contrast::Api::Settings::ApplicationSettings, :application_settings, 3
258
- optional ::Contrast::Api::Settings::AccumulatorSettings, :accumulator_settings, 4
259
- optional ::Contrast::Api::Settings::ProtectState, :protect_state, 5
260
- optional ::Contrast::Api::Settings::InputAnalysis, :input_analysis, 6
261
- end
262
-
263
- class ProtectState
264
- optional :string, :uuid, 1
265
- optional :bool, :track_request, 4
266
- optional :bool, :security_exception, 2
267
- optional :string, :security_message, 3
268
- end
269
-
270
- class ServerFeatures
271
- optional :bool, :cache, 1
272
- optional :string, :log_file, 2
273
- optional :string, :log_level, 3
274
- optional ::Contrast::Api::Settings::InventoryFeatures, :inventory, 4
275
- optional ::Contrast::Api::Settings::AssessFeatures, :assess, 5
276
- optional ::Contrast::Api::Settings::DefendFeatures, :defend, 6
277
- optional ::Contrast::Api::Settings::ServerFeatures::InstrumentationMode, :instrumentation_mode, 7
278
- optional ::Contrast::Api::Settings::ContrastServiceData, :contrast_service, 8
279
- end
280
-
281
- class ContrastServiceData
282
- optional :string, :version, 1
283
- end
284
-
285
- class ApplicationSettings
286
- repeated ::Contrast::Api::Settings::VirtualPatch, :virtual_patches, 2
287
- repeated ::Contrast::Api::Settings::ProtectionRule, :protection_rules, 3
288
- repeated ::Contrast::Api::Settings::Exclusion, :exclusions, 5
289
- repeated :string, :disabled_assess_rules, 6
290
- repeated ::Contrast::Api::Settings::Reaction, :reactions, 7
291
- optional :string, :session_id, 8, :deprecated => true
292
- optional ::Contrast::Api::Settings::SqlInjectionSettings, :sqli_settings, 9
293
- end
294
-
295
- class SqlInjectionSettings
296
- optional :bool, :detect_tautologies, 1
297
- optional :bool, :detect_chained_queries, 2
298
- optional :bool, :detect_suspicious_unions, 3
299
- optional :bool, :detect_dangerous_functions, 4
300
- end
301
-
302
- class Reaction
303
- optional :string, :message, 1
304
- optional ::Contrast::Api::Settings::LogLevel, :log_level, 2
305
- optional ::Contrast::Api::Settings::Reaction::Operation, :operation, 3
306
- end
307
-
308
- class AccumulatorSettings
309
- map :string, ::Contrast::Api::Settings::Accumulator, :accumulators, 1
310
- end
311
-
312
- class InventoryFeatures
313
- optional :bool, :libraries, 1
314
- optional :bool, :activity, 2
315
- optional :bool, :monitor_db, 3
316
- optional :bool, :monitor_ldap, 4
317
- optional :bool, :monitor_web_calls, 5
318
- end
319
-
320
- class AssessFeatures
321
- optional :bool, :enabled, 1
322
- optional :bool, :dynamic_sources, 2
323
- optional :bool, :sources, 3
324
- optional :bool, :rules, 4
325
- optional :bool, :propagators, 5
326
- optional :bool, :taggers, 6
327
- optional :bool, :response_scanning, 7
328
- optional ::Contrast::Api::Settings::AssessFeatures::SaveStacktrace, :stacktraces, 8
329
- optional :bool, :validator_scopes, 9
330
- optional :bool, :identity_tagging, 10
331
- repeated ::Contrast::Api::Settings::CustomRuleFeature, :sanitizers, 11
332
- repeated ::Contrast::Api::Settings::CustomRuleFeature, :validators, 12
333
- repeated :string, :disabled_rules, 13, :deprecated => true
334
- optional ::Contrast::Api::Settings::Sampling, :sampling, 14
335
- map :string, ::Contrast::Api::Settings::DynamicSource, :dynamic_sources_map, 19
336
- end
337
-
338
- class CustomRuleFeature
339
- optional :string, :api, 1
340
- repeated :string, :tags, 2
341
- repeated :string, :rules, 3
342
- end
343
-
344
- class Sampling
345
- optional :bool, :enabled, 1
346
- optional :int32, :baseline, 2
347
- optional :int32, :window_ms, 3
348
- optional :int32, :request_frequency, 4
349
- optional :int32, :response_frequency, 5
350
- end
351
-
352
- class DynamicSource
353
- optional :string, :class_name, 1
354
- optional :string, :method_name, 2
355
- optional :bool, :instance_method, 3
356
- optional :string, :target, 4
357
- map :string, :string, :properties, 6
358
- end
359
-
360
- class DefendFeatures
361
- optional :bool, :enabled, 1
362
- optional :bool, :bot_blocker, 2
363
- repeated ::Contrast::Api::Settings::BotBlocker, :bot_blockers, 3
364
- repeated ::Contrast::Api::Settings::IpFilter, :ip_blacklists, 4, :deprecated => true
365
- repeated ::Contrast::Api::Settings::IpFilter, :ip_denylists, 10
366
- repeated ::Contrast::Api::Settings::IpFilter, :ip_whitelists, 5, :deprecated => true
367
- repeated ::Contrast::Api::Settings::IpFilter, :ip_allowlists, 11
368
- repeated ::Contrast::Api::Settings::LogEnhancer, :log_enhancers, 6
369
- repeated ::Contrast::Api::Settings::RuleDefinition, :rule_definitions, 7
370
- optional ::Contrast::Api::Settings::Syslog, :syslog, 8
371
- optional ::Contrast::Api::Settings::Auth, :auth, 9
372
- end
373
-
374
- class Syslog
375
- optional :bool, :enabled, 1
376
- optional :string, :ip_address, 2
377
- optional :int32, :port, 3
378
- optional :int32, :facility_code, 4
379
- optional ::Contrast::Api::Settings::Syslog::ConnectionType, :connection_type, 5
380
- optional ::Contrast::Api::Settings::Syslog::Severity, :severity_exploited, 6
381
- optional ::Contrast::Api::Settings::Syslog::Severity, :severity_blocked, 7
382
- optional ::Contrast::Api::Settings::Syslog::Severity, :severity_probed, 8
383
- optional ::Contrast::Api::Settings::Syslog::Severity, :severity_blocked_perimeter, 11
384
- optional ::Contrast::Api::Settings::Syslog::Severity, :severity_probed_perimeter, 12
385
- optional :string, :protocol, 9
386
- optional :string, :host, 10
387
- end
388
-
389
- class BotBlocker
390
- optional :string, :bot, 1
391
- optional :bool, :case_sensitive, 2
392
- optional :bool, :start_anchor, 3
393
- end
394
-
395
- class IpFilter
396
- optional :bool, :expires, 1
397
- optional :int64, :expires_at_ms, 2
398
- optional :string, :ip, 3
399
- optional :string, :name, 4
400
- optional :string, :uuid, 5
401
- end
402
-
403
- class LogEnhancer
404
- optional :int64, :id, 1
405
- optional :string, :name, 2
406
- optional :string, :api, 3
407
- optional :string, :format, 4
408
- optional ::Contrast::Api::Settings::LogEnhancer::LogLevel, :log_level, 5
409
- optional ::Contrast::Api::Settings::LogEnhancer::LogType, :log_type, 6
410
- end
411
-
412
- class RuleDefinition
413
- optional :string, :name, 1
414
- repeated ::Contrast::Api::Settings::StringDefinition, :keywords, 2
415
- repeated ::Contrast::Api::Settings::StringDefinition, :patterns, 3
416
- end
417
-
418
- class StringDefinition
419
- optional ::Contrast::Api::Settings::StringDefinition::Type, :type, 1
420
- optional :string, :rule, 2
421
- optional :string, :id, 3
422
- optional :string, :value, 4
423
- optional :string, :downcase, 7
424
- optional :bool, :case_sensitive, 5
425
- optional :int32, :score, 6
426
- end
427
-
428
- class Exclusion
429
- optional ::Contrast::Api::Settings::Exclusion::ExclusionType, :type, 1
430
- optional :string, :name, 2
431
- optional ::Contrast::Api::Settings::Exclusion::MatchStrategy, :match_strategy, 3, :deprecated => true
432
- repeated :string, :modes, 4, :deprecated => true
433
- repeated :string, :protection_rules, 5
434
- repeated :string, :assessment_rules, 6
435
- repeated :string, :urls, 7
436
- repeated :string, :blacklist, 8, :deprecated => true
437
- repeated :string, :denylist, 13
438
- optional ::Contrast::Api::Settings::Exclusion::InputType, :input_type, 9
439
- optional :string, :input_name, 10
440
- optional :bool, :assess, 11
441
- optional :bool, :protect, 12
442
- end
443
-
444
- class VirtualPatch
445
- optional :string, :name, 1
446
- optional :string, :uuid, 2
447
- optional :string, :key, 3
448
- repeated ::Contrast::Api::Settings::VirtualPatchCondition, :headers, 4
449
- repeated ::Contrast::Api::Settings::VirtualPatchCondition, :parameters, 5
450
- repeated ::Contrast::Api::Settings::VirtualPatchCondition, :urls, 6
451
- repeated ::Contrast::Api::Settings::VirtualPatchCondition, :conditions, 7
452
- end
453
-
454
- class VirtualPatchCondition
455
- optional :string, :name, 2
456
- optional :string, :value, 3
457
- optional ::Contrast::Api::Settings::VirtualPatchCondition::InputType, :input_type, 4
458
- optional ::Contrast::Api::Settings::VirtualPatchCondition::Evaluation, :evaluation, 5
459
- end
460
-
461
- class ProtectionRule
462
- optional :string, :id, 1
463
- optional :string, :name, 2
464
- optional ::Contrast::Api::Settings::ProtectionRule::Mode, :mode, 3
465
- end
466
-
467
- class Accumulator
468
- optional :string, :name, 1
469
- optional :int32, :limit, 2
470
- optional :int32, :count, 3
471
- optional :int64, :window_ms, 4
472
- optional :int64, :created_ms, 5
473
- optional :int64, :last_update_ms, 6
474
- end
475
-
476
- class Auth
477
- optional ::Contrast::Api::Settings::Auth::Mode, :mode, 1
478
- end
479
-
480
- class InputAnalysis
481
- repeated ::Contrast::Api::Settings::InputAnalysisResult, :results, 1
482
- end
483
-
484
- class InputAnalysisResult
485
- optional :string, :rule_id, 1
486
- optional ::Contrast::Api::Settings::InputAnalysisResult::InputType, :input_type, 3
487
- optional :string, :path, 4
488
- optional :string, :key, 5
489
- optional :string, :value, 6
490
- optional ::Contrast::Api::Settings::InputAnalysisResult::ScoreLevel, :score_level, 9
491
- repeated :string, :ids, 7
492
- optional :int32, :attack_count, 8
493
- end
494
-
495
- end
496
-
497
- end
498
-
499
- end
500
-
data/lib/contrast/api.rb DELETED
@@ -1,16 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- # Builds out the Contrast::Api namespace and requires the classes in the api
6
- # directory, making available those classes required to communicate with the
7
- # Contrast Service, including those generated from Protobuf
8
- module Api
9
- ENCODING_STRING = 'I>'
10
- end
11
- end
12
-
13
- require 'contrast/api/dtm.pb'
14
- require 'contrast/api/settings.pb'
15
- require 'contrast/api/decorators'
16
- require 'contrast/api/communication'
@@ -1,88 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'monitor'
5
-
6
- module Contrast
7
- module Components
8
- module ContrastService
9
- # A wrapper build around the Common Agent Configuration project to allow
10
- # for access of the values contained in its
11
- # parent_configuration_spec.yaml.
12
- # Specifically, this allows for querying the state of the connection to
13
- # the Service, as well as sending a message to the Service.
14
- class Interface
15
- include Contrast::Components::ComponentBase
16
-
17
- DEFAULT_SERVICE_LOG = 'contrast_service.log'
18
- DEFAULT_SERVICE_LEVEL = :TRACE
19
- # The Rails ActionDispatch regexp for localhost IP + literal localhost
20
- # https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/http/request.rb#L32
21
- LOCALHOST = Regexp.union([
22
- /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, /^::1$/, /^0:0:0:0:0:0:0:1(%.*)?$/,
23
- /^localhost$/
24
- ])
25
-
26
- def use_bundled_service?
27
- # Validates the config to decide if it's suitable for starting
28
- # the bundled service
29
-
30
- # Requirement says "must be true" but that
31
- # should be "must not be false" -- oops.
32
- @_use_bundled_service ||= !false?(::Contrast::CONFIG.agent.start_bundled_service?) &&
33
- # Either a valid host or a valid socket
34
- # Path validity is the service's problem
35
- (LOCALHOST.match?(host) || !!socket_path)
36
- end
37
-
38
- def use_agent_communication?
39
- return @_use_agent_communication unless @_use_agent_communication.nil?
40
-
41
- @_use_agent_communication = true?(::Contrast::CONFIG.agent.service.bypass)
42
- end
43
-
44
- # If we're using the agent directly and not using protect, then there is no need to start the service. Because
45
- # we only know this at startup when hardcoded as such (b/c TS could turn protect on otherwise), we can only do
46
- # so when bypass is on and protect is off in local config
47
- #
48
- # @return [Boolean]
49
- def unnecessary?
50
- ::Contrast::CONTRAST_SERVICE.use_agent_communication? && ::Contrast::PROTECT.forcibly_disabled?
51
- end
52
-
53
- def host
54
- @_host ||=
55
- (::Contrast::CONFIG.agent.service.host || Contrast::Components::Service::Interface::DEFAULT_HOST).to_s
56
- end
57
-
58
- def port
59
- @_port ||=
60
- (::Contrast::CONFIG.agent.service.port || Contrast::Components::Service::Interface::DEFAULT_PORT).to_i
61
- end
62
-
63
- def socket_path
64
- @_socket_path ||= ::Contrast::CONFIG.agent.service.socket
65
- end
66
-
67
- def use_tcp?
68
- socket_path.nil?
69
- end
70
-
71
- def logger_path
72
- @_logger_path ||= ::Contrast::CONFIG.agent.service.logger.path || DEFAULT_SERVICE_LOG
73
- end
74
-
75
- def logger_level
76
- @_logger_level ||= ::Contrast::CONFIG.agent.service.logger.level || DEFAULT_SERVICE_LEVEL
77
- end
78
-
79
- private
80
-
81
- def disabled?
82
- @_disabled = false?(::Contrast::CONFIG.agent.start_bundled_service) if @_disabled.nil?
83
- @_disabled
84
- end
85
- end
86
- end
87
- end
88
- end
@@ -1,55 +0,0 @@
1
- # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- require 'contrast/components/base'
5
- require 'contrast/components/logger'
6
-
7
- module Contrast
8
- module Components
9
- module Service
10
- # A wrapper build around the Common Agent Configuration project to allow
11
- # for access of the values contained in its
12
- # parent_configuration_spec.yaml.
13
- # Those in this section pertain to the communication between the Agent & the Service
14
- class Interface
15
- include Contrast::Components::ComponentBase
16
-
17
- # We don't set these b/c we've been asked to handle the default values of these settings differently, logging
18
- # when we have to use them.
19
- DEFAULT_HOST = '127.0.0.1' # rubocop:disable Style/IpAddresses
20
- DEFAULT_PORT = '30555'
21
-
22
- attr_writer :logger, :bypass
23
- # @return [String, nil]
24
- attr_accessor :socket
25
- # @return [String, nil]
26
- attr_accessor :port
27
- # @return [String, nil]
28
- attr_accessor :host
29
- # @return [Boolean, nil]
30
- attr_accessor :enable
31
-
32
- def initialize hsh = {}
33
- return unless hsh
34
-
35
- @enable = hsh[:enable]
36
- @host = hsh[:host]
37
- @port = hsh[:port]
38
- @socket = hsh[:socket]
39
- @logger = Contrast::Components::Logger::Interface.new(hsh[:logger])
40
- @bypass = hsh[:bypass]
41
- end
42
-
43
- # @return [Contrast::Components::Logger::Interface]
44
- def logger
45
- @logger ||= Contrast::Components::Logger::Interface.new # rubocop:disable Naming/MemoizedInstanceVariableName
46
- end
47
-
48
- # @return [Boolean, false]
49
- def bypass
50
- @bypass.nil? ? false : @bypass
51
- end
52
- end
53
- end
54
- end
55
- end