@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/protect/rules/bot-blocker/bots.json

@@ -1,283 +0,0 @@
-{
-  "sources": {
-    "contrast-security": "Hand-picked",
-    "github": "https://github.com/bluedragonz/bad-bot-blocker/blob/master/.htaccess",
-    "wpsecure": "http://wpsecure.net/bad-bot-list/"
-  },
-  "bots": [{
-    "source": "contrast-security",
-    "includes": "ScanAlert"
-  }, {
-    "source": "contrast-security",
-    "includes": "NESSUS"
-  }, {
-    "source": "contrast-security",
-    "includes": "Sucuri"
-  }, {
-    "source": "contrast-security",
-    "includes": "masscan/1"
-  }, {
-    "source": "contrast-security",
-    "includes": "Acunetix"
-  }, {
-    "source": "contrast-security",
-    "includes": "Nikto"
-  }, {
-    "source": "contrast-security",
-    "startsWith": "CrowdStrike.*"
-  }, {
-    "source": "contrast-security",
-    "includes": "heritrix"
-  }, {
-    "source": "contrast-security",
-    "startsWith": "[mozilla]",
-    "includes": "MJ12bot"
-  }, {
-    "source": "github",
-    "startsWith": "Download Devil"
-  }, {
-    "source": "github",
-    "startsWith": "Download Wonder"
-  }, {
-    "source": "github",
-    "startsWith": "LinkextractorPro"
-  }, {
-    "source": "github",
-    "startsWith": "Xenu"
-  }, {
-    "source": "github",
-    "includes": "ZmEu"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "BlackWidow"
-  }, {
-    "source": "wpsecure",
-    "includes": "craftbot@yahoo.com"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "ChinaClaw"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Custo"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "DISCo"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Download Demon"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "eCatch"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "EirGrabber"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "EmailSiphon"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "EmailWolf"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Express WebPictures"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Extractor"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "EyeNetIE"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "FlashGet"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "GetRight"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "GetWeb!"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Go!Zilla"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Go-Ahead-Got-It"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "GrabNet"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Grafula"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "HMView"
-  }, {
-    "source": "wpsecure",
-    "includes": "HTTrack"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Image Stripper"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Image Sucker"
-  }, {
-    "source": "wpsecure",
-    "includes": "Indy Library"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "InterGET"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Internet Ninja"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "JetCar"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "JOC Web Spider"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "larbin"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "libghttp"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "LeechFTP"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Mass Downloader"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "MIDown tool"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Missigua"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Mister PiX"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Navroad"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "NearSite"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "NetAnts"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "NetSpider"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Net Vampire"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "NetZIP"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Octopus"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Offline Explorer"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Offline Navigator"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "PageGrabber"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Papa Foto"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "pavuk"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "pcBrowser"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "RealDownload"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "ReGet"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "SiteSnagger"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "SmartDownload"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "SuperBot"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "SuperHTTP"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Surfbot"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "tAkeOut"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Teleport Pro"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "VoidEYE"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Web Image Collector"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Web Sucker"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebAuto"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebCopier"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebFetch"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebGo IS"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebLeacher"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebReaper"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebSauger"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Website eXtractor"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Website Quester"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebStripper"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebWhacker"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WebZIP"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Widow"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "WWWOFFLE"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Xaldon WebSpider"
-  }, {
-    "source": "wpsecure",
-    "startsWith": "Zeus"
-  }
-          ]
-}

package/lib/protect/rules/bot-blocker/index.js

@@ -1,93 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-/**
- * Checks a user agent to see if it matches known bad bots.
- * @module lib/rules/protect/bot-check
- */
-
-const { isString } = require('../../../util/is-string');
-const partial = require('../../../util/partial');
-const logger = require('../../../core/logger')('contrast:protect:bot-blocker');
-
-const knownBots = require('./bots');
-
-/**
- * Tester is a function that reads a rule, and returns a test function.
- * The function returned will read an input string and return `true`
- * if it matched a bot defined by the rule.
- * @param   {Object}   rule The rule used to create the test function.
- * @returns {Function}      The function for testing user agent strings.
- */
-const Tester = (function(includes, startsWith) {
-  return function(rule) {
-    const tests = [];
-
-    if (rule.includes) {
-      tests.push(partial(includes, rule.includes));
-    }
-
-    if (rule.startsWith) {
-      tests.push(partial(startsWith, rule.startsWith));
-    }
-
-    return function doChecks(string) {
-      return tests.every((test) => test(string)) ? rule : false;
-    };
-  };
-})(
-  (segment, string) => string.includes(segment),
-  (segment, string) => string.indexOf(segment) === 0
-);
-
-/**
- * Generate rule execution logic from the bots file.
- */
-const tests = knownBots.bots
-  .filter((rule) => {
-    // Make sure the rules are valid.
-    if (
-      !(rule.hasOwnProperty('startsWith') || rule.hasOwnProperty('includes'))
-    ) {
-      logger.warn('Bot missing required fields %j', rule);
-      return false;
-    }
-
-    return rule;
-  })
-  .map((rule) => Tester(rule));
-
-/**
- * Compares an input string against a list of known bad bot signatures.
- * @param   {String}  string The string to check.
- * @returns {Boolean}        If the string matches a known bot signature.
- */
-function isKnownBot(string) {
-  if (!string || !isString(string)) {
-    return false;
-  }
-
-  for (let i = 0; i < tests.length; i++) {
-    const signature = tests[i](string);
-    if (signature) {
-      return signature;
-    }
-  }
-
-  return false;
-}
-
-exports.isKnownBot = isKnownBot;

package/lib/protect/rules/cmd-injection/cmdinjection-rule.js

@@ -1,113 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-/**
- * @module lib/rules/protect/cmd-injection/CMDInjectionRule
- */
-
-'use strict';
-
-const Rule = require('../');
-const { INPUT_TYPES, SINK_TYPES } = require('../common');
-const logger = require('../../../core/logger')('contrast:rules:protect');
-
-class CMDInjectionRule extends Rule {
-  constructor(policy, agent) {
-    super(policy, agent);
-
-    this.id = 'cmd-injection';
-    this.name = 'Command Injection';
-    this.applicableInputs = [
-      INPUT_TYPES.BODY,
-      INPUT_TYPES.COOKIE_NAME,
-      INPUT_TYPES.COOKIE_VALUE,
-      INPUT_TYPES.HEADER,
-      INPUT_TYPES.JSON_VALUE,
-      INPUT_TYPES.JSON_ARRAYED_VALUE,
-      INPUT_TYPES.PARAMETER_NAME,
-      INPUT_TYPES.PARAMETER_VALUE,
-      INPUT_TYPES.QUERYSTRING,
-      INPUT_TYPES.XML_VALUE,
-      INPUT_TYPES.URI,
-      INPUT_TYPES.URL_PARAMETER
-    ];
-    this.applicableSinks = [SINK_TYPES.COMMAND];
-
-    this.usesLibInputAnalysis = true;
-  }
-
-  /**
-   * Calls down to the agent analysis library for evaluation with the
-   * @param {Samples} applicableSamples Samples cache
-   * @param {Set} params.applicableSamples samples applicable to rule id
-   */
-  evaluateAtSinkForLib({ event, applicableSamples }) {
-    if (applicableSamples.size == 0 || !event.data) {
-      return;
-    }
-
-    for (const sample of applicableSamples) {
-      let evalResult = null;
-      try {
-        const input = sample.input.value;
-        const sinkData = event.data;
-        const inputIndex = sinkData.indexOf(input);
-
-        if (inputIndex !== -1) {
-          evalResult = this.agent.agentLib.checkCommandInjectionSink(
-            inputIndex,
-            input.length,
-            sinkData,
-          );
-        }
-      } catch (e) {
-        logger.info(`Failed to evaluate command-injection sink: ${e}`);
-      }
-
-      if (evalResult) {
-        this.appendAttackDetails(sample, evalResult);
-        sample.captureAppContext(event);
-        logger.warn(`EFFECTIVE - rule: ${this.id}, mode: ${this.mode}`);
-        this.blockRequest(sample);
-      }
-    }
-  }
-
-  /**
-   * Builds the details for TS UI rendering.
-   * @param   {Sample} sample   N/a in this rule's case
-   * @param   {String} findings The command string
-   * @returns {Object}
-   */
-  buildDetails(sample, findings) {
-    return { command: findings };
-  }
-
-  /**
-   * Builds the details for TS UI rendering based on agent lib findings.
-   * @param   {Sample} sample   relevant protect sample
-   * @param   {Object} findings The results from the agent library
-   * @returns {Object}
-   */
-  buildDetailsForLib(sample, findings) {
-    return {
-      command: sample.input.value.substring(
-        findings.startIndex,
-        findings.endIndex
-      )
-    };
-  }
-}
-
-module.exports = CMDInjectionRule;

package/lib/protect/rules/cmd-injection-command-backdoors/backdoor-detector.js

@@ -1,103 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-const { INPUT_TYPES } = require('../common');
-const SINK_EXPLOIT_PATTERN_START = /(?:^|\\|\/)(?:sh|bash|zsh|ksh|tcsh|csh|fish|cmd)/;
-const stripWhiteSpace = (str) => str.replace(/\s/g, '');
-const REQUEST_KEYS = {
-  queryParams: INPUT_TYPES.QUERYSTRING,
-  body: INPUT_TYPES.BODY,
-  parameters: INPUT_TYPES.PARAMETER_VALUE,
-  headers: INPUT_TYPES.HEADER,
-  cookies: INPUT_TYPES.COOKIE_VALUE
-};
-const UserInput = require('../../../reporter/models/app-activity/user-input');
-const { isString } = require('../../../util/is-string');
-const { traverse } = require('../../../util/traverse');
-
-module.exports = class BackdoorDetector {
-  constructor({ command, request, event }) {
-    this.command = command;
-    this.request = request;
-    this.normalizedCmd = stripWhiteSpace(command);
-    this.event = event;
-  }
-
-  /**
-   * Backdoor detection logic:
-   *  - command is >= 2 chars
-   *  - iterates over every piece of request and checks
-   *    - the full value is the param to sink
-   *    - the value matches a regex and ends the param to the sink
-   *
-   */
-  findInjection() {
-    if (this.command && this.command.length < 2) {
-      return null;
-    }
-
-    let found = false;
-    for (const part in REQUEST_KEYS) {
-      const values = this.request[part];
-      if (values) {
-        let docPath = [];
-        traverse(values, (key, value, depth) => {
-          if (depth === 1) {
-            docPath = [key];
-          } else if (depth > 1) {
-            docPath.push(key);
-          }
-
-          if (
-            !found &&
-            value &&
-            isString(value) &&
-            this.isBackdoorDetected(value)
-          ) {
-            const type =
-              docPath.length > 1 ? INPUT_TYPES.JSON_VALUE : REQUEST_KEYS[part];
-            const path = docPath.join('.');
-
-            found = new UserInput({
-              path,
-              name: path,
-              value: this.command,
-              type
-            });
-          }
-        });
-      }
-    }
-
-    return found;
-  }
-
-  /**
-   * strips the whitespace of the request value
-   * checks if the param equals the request value
-   * or if the command looks like the start of a shell execution
-   * and ends the command passed to sink
-   *
-   * @param {string} value from request key
-   */
-  isBackdoorDetected(requestValue) {
-    const normalizedParam = stripWhiteSpace(requestValue);
-    return (
-      normalizedParam === this.normalizedCmd ||
-      (this.normalizedCmd.endsWith(normalizedParam) &&
-        SINK_EXPLOIT_PATTERN_START.test(this.normalizedCmd))
-    );
-  }
-};

package/lib/protect/rules/cmd-injection-command-backdoors/cmd-injection-command-backdoors-rule.js

@@ -1,90 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const {
-  SINK_TYPES,
-  IMPORTANCE,
-  CMD_INJECTION_SEMANTIC_TYPES
-} = require('../../../constants');
-const Rule = require('../');
-const BackdoorDetector = require('./backdoor-detector');
-
-class CMDInjectionCommandBackdoorsRule extends Rule {
-  constructor(policy) {
-    super(policy);
-    this.id = 'cmd-injection-command-backdoors';
-    this.name = 'Command Injection Command Backdoors';
-    this.applicableSinks = [SINK_TYPES.COMMAND];
-  }
-
-  /**
-   * By returning `false` this rule will bypass input classification stage.
-   * @returns {boolean}
-   */
-  appliesToInputType() {
-    return false;
-  }
-
-  /**
-   * Performs an input tracing search w/ semantic analysis. Input tracing is not
-   * performed by looking at samples captured by input analysis; request fields
-   * are checked directly.
-   * @param {ApplicationContext} event Sink event
-   * @param {Request} request Request model
-   * @param {Samples} samples Samples cache
-   */
-  evaluateAtSink({ event, request, samples }) {
-    const { data: command } = event;
-    const backdoor = new BackdoorDetector({
-      command,
-      event,
-      request: event.request || request
-    });
-    const input = backdoor.findInjection();
-
-    if (input) {
-      const sample = this.createAndSaveSample({
-        input,
-        attributes: { effective: true },
-        classification: IMPORTANCE.DEFINITE,
-        event,
-        samples,
-        request
-      });
-
-      this.appendAttackDetails(sample, {
-        command,
-        findings: [CMD_INJECTION_SEMANTIC_TYPES.BACKDOOR]
-      });
-
-      this.blockRequest(sample);
-    }
-  }
-
-  /**
-   * Builds the details for TS UI rendering.
-   * @param   {Sample} sample   N/a in this rule's case
-   * @param   {Object} sinkData
-   * @param   {String} sinkData.command The command string
-   * @param   {String[]} sinkData.findings Backdoor flag
-   * @returns {Object}
-   */
-  buildDetails(sample, { command, findings }) {
-    return { command, findings };
-  }
-}
-
-module.exports = CMDInjectionCommandBackdoorsRule;