@contrast/agent 4.31.2 → 5.0.0-alpha.1

package/lib/protect/rules/rule-factory.js

@@ -1,250 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const _ = require('lodash');
-
-const logger = require('../../core/logger')('contrast:protect:rules');
-const SignatureKit = require('./signatures');
-const { PROTECTION_MODES, RULES } = require('./common');
-
-const DEFAULT_SETTINGS = { serverFeatures: { defend: { enabled: false } } };
-
-/**
- * Hash of constructors by rule id. Once a rule has been fully
- * implemented, we add its constructor path to provide support.
- */
-const ctors = {
-  // protect rules
-  [RULES.CMD_INJECTION]: require('./cmd-injection/cmdinjection-rule'),
-  [RULES.CMD_INJECTION_COMMAND_BACKDOORS]: require('./cmd-injection-command-backdoors/cmd-injection-command-backdoors-rule'),
-  [RULES.CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS]: require('./cmd-injection-semantic-chained-commands/cmd-injection-semantic-chained-commands-rule'),
-  [RULES.CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS]: require('./cmd-injection-semantic-dangerous-paths/cmd-injection-semantic-dangerous-paths-rule.js'),
-  [RULES.METHOD_TAMPERING]: require('./method-tampering/method-tampering-rule'),
-  [RULES.NOSQL_INJECTION]: require('./nosqli/nosql-injection-rule'),
-  [RULES.PATH_TRAVERSAL]: require('./path-traversal/path-traversal-rule'),
-  [RULES.REFLECTED_XSS]: require('./xss/reflected-xss-rule'),
-  [RULES.SQL_INJECTION]: require('./sqli/sql-injection-rule'),
-  [RULES.SSJS_INJECTION]: require('./ssjs-injection/ssjsinjection-rule'),
-  [RULES.UNSAFE_FILE_UPLOAD]: require('./unsafe-file-upload/unsafe-file-upload-rule'),
-  [RULES.UNTRUSTED_DESERIALIZATION]: require('./untrusted-deserialization/untrusted-deserialization-rule'),
-  [RULES.XXE]: require('./xxe/xxerule.js'),
-  // blocking rules
-  [RULES.BOT_BLOCKER]: require('./bot-blocker/bot-blocker-rule'),
-  [RULES.IP_DENYLIST]: require('./ip-denylist/ip-denylist-rule'),
-  [RULES.VIRTUAL_PATCH]: require('./virtual-patch/virtual-patch-rule'),
-};
-
-class ProtectRuleFactory {
-  constructor({ featureSet = DEFAULT_SETTINGS, enabled, agent }) {
-    this.featureSet = featureSet;
-    this.settings = {
-      exceptions: []
-    };
-    this.agent = agent;
-    this.policies = {};
-    this.signatures = new SignatureKit();
-
-    this.updateSettings(featureSet.applicationSettings, enabled);
-    this.updateSettings(featureSet.serverFeatures, enabled);
-  }
-
-  /**
-   * Used for when updates are provided by TS feature set.
-   * @param {Object} settings ApplicationSettings or ServerFeatures
-   * @param {Boolean} enabled flag to say whether protect is enabled(set from merge of config and TS Settings)
-   */
-  updateSettings(settings, enabled) {
-    if (enabled !== undefined) {
-      logger.info(`Protect mode ${enabled ? 'enabled' : 'disabled'}`);
-      this.enabled = enabled;
-    }
-
-    // The `settings` argument can be either of these types:
-    this.updateServerFeatures(settings);
-    this.updateApplicationSettings(settings);
-
-    this.updatePolicies();
-
-    return this;
-  }
-
-  /**
-   * Regenerates protect rule policies used to create rule instances. This will
-   * run when updates are recieved from TS.
-   */
-  updatePolicies() {
-    for (const id in ctors) {
-      const policy = this.featureSet.getProtectRulePolicy(id);
-
-      logger.info(`Protect rule ${id} in mode ${policy.mode}`);
-      this.policies[id] = policy;
-    }
-  }
-
-  /**
-   * Reads the ServerFeatures from the settings and updates if found.
-   * @param {Object} settings ApplicationSettings or ServerFeatures
-   */
-  updateServerFeatures(settings) {
-    const definitionList = _.get(
-      this,
-      'featureSet.serverFeatures.defend.ruleDefinitionsList'
-    );
-    if (definitionList) {
-      logger.info(`Definition list updated. Total: ${definitionList.length}`);
-      this.signatures = new SignatureKit(definitionList);
-    }
-
-    const denylist = _.get(settings, 'defend.ipDenylistsList');
-    if (denylist) {
-      logger.info(`IP Denylist updated. Total: ${denylist.length}`);
-    }
-  }
-
-  /**
-   * Reads the ApplicationSettings from the settings and updates if found.
-   * @param {Object} settings ApplicationSettings or ServerFeatures
-   */
-  updateApplicationSettings(settings) {
-    const ruleSettings = _.get(settings, 'protectionRulesList');
-    const virtualPatches = _.get(settings, 'virtualPatchesList');
-
-    if (ruleSettings) {
-      logger.info(
-        `Defend protection rules updated. Total: ${ruleSettings.length}`
-      );
-    }
-
-    if (virtualPatches) {
-      logger.info('Defend Virtual Patches updated');
-    }
-  }
-
-  /**
-   * Will return a set of active rules for the current request.
-   * @param   {String} mode Defaults to 'defend'
-   * @returns {Rule[]}
-   */
-  getRules() {
-    // This will disable the factory if settings state is invalid.
-    if (!this.ensureValidSettingsState()) {
-      return [];
-    }
-
-    // Blocking rules are in front so that they can run first. If
-    // applicable they will then disable themselves.
-    const rules = [
-      this.IpDenylist(),
-      this.BotBlocker(),
-      ...this.VirtualPatchRules(),
-      ...this.ProtectionRules()
-    ];
-
-    return rules.filter((rule) => rule.isEnabled());
-  }
-
-  /**
-   * There are cases where protect may be enabled but the requisite settings
-   * information has not been received from TS in order for the feature to be
-   * fully functional. In these cases we want to log this fact and disable.
-   * @returns {Boolean}
-   */
-  ensureValidSettingsState() {
-    if (_.isEmpty(this.signatures) && this.enabled) {
-      logger.info('Protect is disabled until rule definitions are obtained');
-      this.enabled = false;
-      return false;
-    }
-
-    return true;
-  }
-
-  /**
-   * Creates IpDenylistRule.
-   * @param   {Object[]} settings Rule settings from TS
-   * @returns {IpDenylistRule}
-   */
-  IpDenylist() {
-    const policy = this.policies[RULES.IP_DENYLIST];
-    return new ctors[RULES.IP_DENYLIST](policy, this.agent);
-  }
-
-  /**
-   * Creates BotBlockerRule.
-   * @returns {[BotBlockerRule]}
-   */
-  BotBlocker() {
-    const policy = this.policies[RULES.BOT_BLOCKER];
-    return new ctors[RULES.BOT_BLOCKER](policy, this.agent);
-  }
-
-  /**
-   * Creates and returns a collection of virtual patch rules.
-   * @returns {Rule[]}
-   */
-  VirtualPatchRules() {
-    return this.policies[RULES.VIRTUAL_PATCH].map(
-      (policy) => new ctors[RULES.VIRTUAL_PATCH](policy, this.agent)
-    );
-  }
-
-  /**
-   * Creates Rule instances from the protection rule Settings
-   * @returns {Rule[]}
-   */
-  ProtectionRules() {
-    const enableRep = _.get(this, 'featureSet.config.protect.enable_rep');
-
-    return Object.values(this.policies).reduce((memo, policy) => {
-      const { id } = policy;
-
-      // These are built and ordered specially
-      if (
-        id === RULES.VIRTUAL_PATCH ||
-        id === RULES.BOT_BLOCKER ||
-        id === RULES.IP_DENYLIST
-      ) {
-        return memo;
-      }
-
-      policy.enable_rep = enableRep;
-
-      if (ProtectRuleFactory.shouldBuildRule(policy)) {
-        const rule = new ctors[id](policy, this.agent);
-        rule.signature = this.signatures.get(id);
-        memo.push(rule);
-      }
-
-      return memo;
-    }, []);
-  }
-
-  /**
-   * Whether the factory should build a rule described by the given policy.
-   * @param {Object} policy Derived from TS settings and configuration
-   * @returns {Boolean}
-   */
-  static shouldBuildRule(policy) {
-    return (
-      policy.enable && // can be disabled in config
-      policy.mode !== PROTECTION_MODES.NO_ACTION && // noop mode
-      policy.id in ctors // unknown afa implementation
-    );
-  }
-}
-
-module.exports = ProtectRuleFactory;
-module.exports.constructors = ctors;

package/lib/protect/rules/signatures/cmd-injection/config.json

@@ -1,8 +0,0 @@
-{
-  "id": "cmd-injection",
-  "type": "Command Injection",
-  "definiteThreshold": 3,
-  "watchThreshold": 2,
-  "minimumInputLength": 3,
-  "exploitChars": [";","|","&","$","<",">","`","\t","\n","\f","\r"," "]
-}

package/lib/protect/rules/signatures/cmd-injection/custom-searchers/chained-command-searcher.js

@@ -1,117 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * Searches an input string looking for chained command patterns.
- * @module lib/rules/protect/cmd-injection/custom-searchers/ChainedCommandSearcher
- */
-
-'use strict';
-
-const Builder = require('../../../attack-patterns');
-const { CustomSearcher } = require('../../signature');
-const config = require('../config');
-
-const common = require('../../../common');
-const { SCORES } = common;
-
-const commandLiterals = [
-  'wget',
-  'uname',
-  'dir',
-  'netstat',
-  'nc',
-  'echo',
-  'ping',
-  'whoami'
-];
-
-const builderPatternNames = [
-  'anyUsrBin',
-  'echoToFile',
-  'catToFile',
-  'netcat',
-  'netstat',
-  'ping',
-  'uname',
-  'whoami',
-  'wget'
-];
-
-/**
- * Returns a function that tests whether an input string
- * matches chained command patterns. The regular expressions
- * are built once and used for each test function via closure.
- * @param {string} value The string to test
- * @returns {boolean} Whether any patterns match
- */
-const matchesCommandPattern = (value) =>
-  builderPatternNames.some((name) => {
-    const rx = Builder()
-      .anyOf(config.exploitChars)
-      .whitespaces()
-      .CMD()
-      [name]()
-      .build();
-
-    return rx.test(value);
-  });
-
-/**
- * Returns a function that tests whether an input string
- * matches chained command patterns starting with <code>&&</code>.
- * The regular expressions are built once and used for each test
- * function via closure.
- * @param {string} value The string to test
- * @returns {boolean} Whether any patterns match
- */
-const matchesDoubleAndPattern = (value) =>
-  commandLiterals.some((command) => {
-    const rx = Builder()
-      .literally('&&', true)
-      .whitespaces()
-      .literally(command, true)
-      .build();
-
-    return rx.test(value);
-  });
-
-/**
- * Tests whether an input string matches any chained command patterns.
- * All patterns score HIGH.
- */
-class ChainedCommandSearcher extends CustomSearcher {
-  constructor() {
-    super();
-    this.description =
-      'Tests whether an input string matches chained command patterns.';
-    this.id = 'CMDI-CCS-1';
-    this.name = 'ChainedCommandSearcher';
-  }
-
-  /**
-   * @param {Object} userInput
-   * @param {string} userInput.value
-   * @returns {string}
-   */
-  getImpact(userInput) {
-    const isMatch =
-      matchesCommandPattern(userInput.value) ||
-      matchesDoubleAndPattern(userInput.value);
-
-    return isMatch ? SCORES.HIGH : SCORES.NONE;
-  }
-}
-
-module.exports = new ChainedCommandSearcher();

package/lib/protect/rules/signatures/cmd-injection/custom-searchers/index.js

@@ -1,26 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module lib/rules/protect/cmd-injection/custom-searchers
- */
-
-'use strict';
-
-module.exports = ['chained-command-searcher'].map((name) => {
-  const path = `./${name}`;
-  const searcher = require(path);
-  searcher.type = 'custom';
-  return searcher;
-});

package/lib/protect/rules/signatures/cmd-injection/index.js

@@ -1,30 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const _ = require('lodash');
-
-const Signature = require('../signature');
-const config = require('./config');
-const customSearchers = require('./custom-searchers');
-
-class CMDInjectionSignature extends Signature {
-  constructor(definition) {
-    super(definition);
-    _.merge(this, config, { customSearchers });
-  }
-}
-
-module.exports = CMDInjectionSignature;

package/lib/protect/rules/signatures/evaluator.js

@@ -1,187 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const _ = require('lodash');
-const logger = require('../../../core/logger')('contrast:protect:signature');
-const Assessment = require('../assessment');
-const {
-  REQUIRED_SIGNATURE_KEYS,
-  IMPORTANCE,
-  SCORES,
-  THRESHOLDS,
-  WEIGHTS
-} = require('../common');
-
-class SignatureEvaluator {
-  constructor(signature = {}) {
-    this.breakOnThreshold = true;
-    this.haltingScore = signature.definiteThreshold;
-
-    this.validate(signature);
-    this.signature = signature;
-  }
-
-  validate(signature) {
-    const badKeys = REQUIRED_SIGNATURE_KEYS.filter(
-      (key) => !signature.hasOwnProperty(key)
-    );
-
-    if (badKeys.length) {
-      logger.warn(
-        'Invalid signature, missing the following properties: %s',
-        badKeys.join(', ')
-      );
-    }
-  }
-
-  /**
-   *
-   * @param {} userInput
-   * @param {} assessment
-   * @returns {}
-   */
-  evaluate(userInput, assessment) {
-    assessment = assessment || Assessment();
-
-    if (!this.meetsEvalCriteria(userInput.value)) {
-      return assessment.details();
-    }
-
-    const options = { thresholdMet: false, stringLower: '' };
-
-    const searchers = [
-      ...this.signature.keywordSearchers,
-      ...this.signature.patternSearchers,
-      ...this.signature.customSearchers
-    ];
-
-    this.evaluateSearchers(searchers, assessment, userInput, options);
-
-    const details = assessment.details();
-
-    this.setImportance(assessment, details.results);
-
-    return details;
-  }
-
-  evaluateSearchers(searchers, assessment, userInput, options) {
-    const method = this.breakOnThreshold ? 'some' : 'forEach';
-
-    searchers[method]((searcher) => {
-      // Don't run if we've matched already
-      if (assessment.has(searcher)) {
-        return false;
-      }
-
-      // Word score ( NONE | LOW | MED | HIGH | CRITICAL )
-      const impact = searcher.getImpact(userInput);
-
-      if (impact != SCORES.NONE) {
-        assessment.add(searcher, impact);
-        if (this.isHaltingImpact(impact)) {
-          assessment.confident(true);
-        }
-      }
-
-      return (
-        this.breakOnThreshold &&
-        assessment.confident() &&
-        this.signature.definiteThreshold <= assessment.results().points
-      );
-    });
-
-    return this;
-  }
-
-  /**
-   * Given a score, will return whether it is significant enough to
-   * halt the current rule's evaluation. Set by the signature `definiteThreshold` value.
-   * @param   {String}  score The score to check for halting ability.
-   * @returns {Boolean}
-   */
-  isHaltingImpact(score) {
-    return this.haltingScore <= WEIGHTS[score];
-  }
-
-  /**
-   * Calculates the importance from the assessment and sets the value on
-   * the result set given.
-   * @param {Object} assessment Used for calulation.
-   * @param {Object} results    The value on which to mark calculated value.
-   */
-  setImportance(assessment, results) {
-    const meets = this.meetsThreshold.bind(this, assessment);
-    const importance = assessment.confident()
-      ? IMPORTANCE.DEFINITE
-      : meets(THRESHOLDS.DEFINITE)
-      ? IMPORTANCE.DEFINITE
-      : meets(THRESHOLDS.WATCH)
-      ? IMPORTANCE.WORTH_WATCHING
-      : IMPORTANCE.NONE;
-
-    results.importance = importance;
-
-    // The purpose of this method is to only to update @results.
-    // We'll return `this`, so we can chain.
-    return this;
-  }
-
-  /**
-   * Returns true if the assessment has the same threshold as the one supplied.
-   * If none is given, will compute and return the threshold met by the assessment.
-   * @param   {Object}            assessment  The assessment to examine
-   * @param   {THRESHOLD}         [threshold] Check if the assessment meets this.
-   * @returns {Boolean|THRESHOLD}
-   */
-  meetsThreshold(assessment, threshold) {
-    const { points } = assessment.results();
-
-    if (threshold) {
-      // return Boolean
-      return threshold === THRESHOLDS.DEFINITE
-        ? this.signature.definiteThreshold <= points
-        : threshold === THRESHOLDS.WATCH
-        ? this.signature.watchThreshold <= points
-        : false;
-    } else {
-      // return THRESHOLD
-      return this.signature.definiteThreshold <= points
-        ? THRESHOLDS.DEFINITE
-        : this.signature.definiteThreshold <= points
-        ? THRESHOLDS.WATCH
-        : null;
-    }
-  }
-
-  meetsEvalCriteria(string) {
-    if (!string) {
-      return false;
-    }
-
-    const chars = this.signature.exploitChars;
-
-    const length = this.signature.minimumInputLength;
-    const hasChars = !_.isEmpty(chars)
-      ? _.some(chars, (c) => string.includes(c))
-      : true;
-
-    const longEnough = (length || 0) <= string.length ? true : false;
-
-    return hasChars && longEnough;
-  }
-}
-
-module.exports = SignatureEvaluator;

package/lib/protect/rules/signatures/index.js

@@ -1,83 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const logger = require('../../../core/logger')('contrast:protect:signatures');
-const Evaluator = require('./evaluator');
-
-class SignatureKit extends Map {
-  /**
-   * @param {Object[]} definitions Keywords and patterns for all rules
-   */
-  constructor(definitions) {
-    // Make definitions into enumerable instances
-    super(configure(definitions));
-  }
-
-  static setEvaluator(signature) {
-    if (!signature.evaluator) {
-      signature.evaluator = new Evaluator(signature);
-    }
-    return signature;
-  }
-
-  static setCustomSearchers(signature) {
-    if (!signature.customSearchers) {
-      signature.customSearchers = [];
-    }
-    return signature;
-  }
-
-  static setDefaultThresholds(signature) {
-    if (!signature.watchThreshold) {
-      signature.watchThreshold = Infinity;
-    }
-    if (!signature.definiteThreshold) {
-      signature.definiteThreshold = Infinity;
-    }
-
-    return signature;
-  }
-}
-
-module.exports = SignatureKit;
-module.exports.configure = configure;
-
-/**
- * Given a rule definition list configuration, the instance builds
- * its set of signatures from the local constructors.
- * Each signature becomes accessible by name on the instance.
- * @param {Object[]} definitions Keywords and patterns for all rules
- */
-function configure(definitions = []) {
-  return definitions.map((def) => {
-    let signature, Ctor;
-    try {
-      const sigPath = `./${def.name}`;
-      Ctor = require(sigPath);
-      signature = new Ctor(def);
-    } catch (e) {
-      logger.debug(`Signature CreationError "${def.name}" - ${e.message}`);
-      return [];
-    }
-
-    signature = new Ctor(def);
-    SignatureKit.setEvaluator(signature);
-    SignatureKit.setCustomSearchers(signature);
-    SignatureKit.setDefaultThresholds(signature);
-
-    return [def.name, signature];
-  });
-}