@contrast/agent 4.32.0 → 5.0.0-alpha.1

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/link-and-src-target-searcher.js

@@ -1,145 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const { SCORES, WEIGHTS: IMPACT } = require('../../../common');
-
-const dataPattern = /^data:/;
-const hexPattern = /&#x((\d|A-F|a-f){2,4});?/;
-const htmlPattern = /&#\d{2,4};?/;
-const httpPattern = /^https?:\/\//;
-const ipPattern = /(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/;
-const linkPattern = /<a.*href\s*=\s*(.+)>/gi;
-const numericPattern = /http:\/\/\d+/;
-const scriptPattern = /^((java|live)script)/;
-const srcPattern = /<img.*src\s*=\s*(.+)>/gi;
-const urlPattern = /%([67])(\d|([A-F]))/;
-
-/**
- * @param {string} target
- * @returns {string}
- */
-const stripQuotes = (target) => {
-  if (!target) return target;
-
-  const firstChar = target.charAt(0);
-  if (firstChar === "'" || firstChar === '"' || firstChar === '`') {
-    const nextTick = target.substring(1).indexOf(firstChar);
-    const actualSrc = target.substring(1, nextTick + 1);
-    return actualSrc;
-  }
-  return target;
-};
-
-/**
- * @param {string} target
- * @returns {boolean}
- */
-const isHighImpact = (target) =>
-  dataPattern.test(target) ||
-  scriptPattern.test(target) ||
-  htmlPattern.test(target) ||
-  hexPattern.test(target);
-
-/**
- * @param {string} value
- * @returns {number}
- */
-const calculateSuspiciousScore = (value) => {
-  if (!value) return IMPACT.NONE;
-
-  const target = value.replace(/s*/, '');
-  if (isHighImpact(target)) return IMPACT.HIGH;
-
-  let score = IMPACT.NONE;
-  if (httpPattern.test(target)) score += 1;
-  if (urlPattern.test(target)) score += 2;
-  if (ipPattern.test(target)) score += 2;
-  if (numericPattern.test(target)) score += 2;
-  return score;
-};
-
-/**
- * @param {string} value
- * @param {RegExp} pattern
- * @returns {number}
- */
-const getImpactOfPattern = (value, pattern) => {
-  let maxScore = IMPACT.NONE;
-  let matches;
-  while ((matches = pattern.exec(value)) !== null) {
-    if (matches) {
-      for (let i = 0; i < matches.length; i++) {
-        if (matches[i]) {
-          const target = stripQuotes(matches[i]);
-          const targetScore = calculateSuspiciousScore(target);
-          if (targetScore >= IMPACT.CRITICAL) return IMPACT.CRITICAL;
-          maxScore = Math.max(targetScore, maxScore);
-        }
-      }
-    }
-  }
-  return maxScore;
-};
-
-/**
- * @param {number} score
- * @returns {string}
- */
-const getScoreRanking = (score) => {
-  if (score >= IMPACT.CRITICAL) return SCORES.CRITICAL;
-  if (score >= IMPACT.HIGH) return SCORES.HIGH;
-  if (score >= IMPACT.MEDIUM) return SCORES.MEDIUM;
-  if (score >= IMPACT.LOW) return SCORES.LOW;
-  return SCORES.NONE;
-};
-
-class LinkAndSrcTargetSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description: 'Searches for a link & src.',
-      id: 'CS-TARGET-1',
-      name: 'Link and Src Searcher'
-    });
-  }
-
-  /**
-   * Returns an impact score for the provided user input.
-   * @param {Object} userInput
-   * @param {string} userInput.value
-   * @returns {number}
-   */
-  getImpact({ value }) {
-    const linksImpact = getImpactOfPattern(value, linkPattern);
-    if (linksImpact > IMPACT.CRITICAL) return SCORES.CRITICAL;
-    const srcImpact = getImpactOfPattern(value, srcPattern);
-    const score = Math.max(linksImpact, srcImpact, IMPACT.NONE);
-    const ranking = getScoreRanking(score);
-    return ranking;
-  }
-
-  /**
-   * Returns a string with surrounding quotes (single, double, and backticks)
-   * removed.
-   * @param {string} target
-   * @returns {string}
-   */
-  stripQuotes(target) {
-    return stripQuotes(target);
-  }
-}
-
-module.exports = new LinkAndSrcTargetSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/location-set-searcher.js

@@ -1,72 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-const Builder = require('../../../attack-patterns');
-
-const { SCORES } = common;
-const TERMS = {
-  CONCAT_OPERATOR: '+',
-  LOCATION: 'location'
-};
-
-const locationSearch = Builder()
-  .literally(TERMS.LOCATION)
-  .JS()
-  .blockOrInlineComments()
-  .literally('=')
-  .zeroOrMoreOf()
-  .anything()
-  .build();
-
-const concatSearch = Builder()
-  .JS()
-  .concatenation()
-  .build();
-
-class LocationSetSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description: 'Searches for a location being set.',
-      id: 'CS-LOC-1',
-      name: 'Location set searcher'
-    });
-  }
-
-  getImpact(userInput) {
-    const locationIndex = userInput.value.indexOf(TERMS.LOCATION);
-    if (locationIndex < 0) {
-      return SCORES.NONE;
-    }
-
-    const patternIndex = userInput.value.search(locationSearch);
-    if (patternIndex < 0) {
-      return SCORES.NONE;
-    }
-
-    const concatIndex = userInput.value.indexOf(
-      TERMS.CONCAT_OPERATOR,
-      locationIndex + 8
-    );
-
-    return 0 <= concatIndex && concatSearch.test(userInput.value)
-      ? SCORES.HIGH
-      : SCORES.LOW;
-  }
-}
-
-module.exports = new LocationSetSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/map-access-searcher.js

@@ -1,102 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-const Builder = require('../../../attack-patterns');
-
-const { SCORES } = common;
-const KEYWORDS = [
-  'document',
-  'location',
-  'window',
-  'top',
-  'this',
-  'parent',
-  'self',
-  'frames'
-];
-
-const mapAccessSearch = Builder()
-  .JS()
-  .anyOf(KEYWORDS)
-  .blockOrInlineComments()
-  .literally('[')
-  .zeroOrMoreOf()
-  .anything()
-  .literally(']')
-  .build();
-//    =>
-//    (document|location|window|top|this|parent|self|frames)(?:\s*)(?:\/\*[\\s\\S]*\*\/)?(?:\s*)\[[\\s\\S]*\]
-
-const invocationSearch = Builder()
-  .JS()
-  .functionCall()
-  .build();
-
-/**
- * Search for map access of an object, like:
- *   window[/*../ 'na' + 'me']
- *   document["location"]
- *   document /*../  [  "locat" + "ion" + "" ]
- * We heighten the impact from MEDIUM to HIGH if we see a method invocation
- * afterwards, like:
- *   window["alert"]()
- *
- * @returns {CustomSearcher}
- */
-class MapAccessSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description:
-        'Search for bracket-style access to an object e.g. obj["prop"].',
-      id: 'CS-EVADE-MAPACCESS',
-      name: 'Map access searcher'
-    });
-  }
-
-  getImpact(userInput) {
-    let impact;
-
-    KEYWORDS.some(function(keyword) {
-      const keywordIndex = userInput.value.indexOf(keyword);
-      if (keywordIndex < 0) {
-        impact = SCORES.NONE;
-        return true;
-      }
-
-      const patternIndex = userInput.value.search(
-        mapAccessSearch,
-        keywordIndex
-      );
-      if (patternIndex < 0) {
-        impact = SCORES.NONE;
-        return true;
-      }
-
-      impact =
-        0 <= userInput.value.search(invocationSearch, patternIndex)
-          ? SCORES.HIGH
-          : SCORES.MEDIUM;
-
-      return true;
-    });
-
-    return impact;
-  }
-}
-
-module.exports = new MapAccessSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/native-function-execution-searcher.js

@@ -1,82 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-const Builder = require('../../../attack-patterns');
-const { FunctionCall } = require('../helpers/function-call');
-const { SCORES } = common;
-const COMMON_FUNCTIONS = [
-  'alert',
-  'confirm',
-  'prompt',
-  'eval',
-  'substring',
-  'setTimeout',
-  'setInterval',
-  'setImmediate',
-  'showmodaldialog',
-  'Browser.msgBox'
-];
-
-const invocationSearch = Builder()
-  .JS()
-  .anyOf(COMMON_FUNCTIONS)
-  .blockOrInlineComments()
-  .anyOf(
-    [
-      '(`.*`)', // template literal invocation
-      '(\\(.*\\))'
-    ],
-    true
-  ) // paren. invocation
-  .build();
-
-/**
- * Searches for a common function being called.
- * Functions can be invoked in the following ways:
- * alert()              CallExpression Arguments
- * confirm/*../()            ''           ''
- * prompt  ()                ''           ''
- * eval ` `             CallExpression TemplateLiteral
- *                         a.k.a. tagged template
- */
-class NativeFunctionExecutionSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description: 'Searches for a native function being called.',
-      id: 'CS-EXP-2',
-      name: 'Native function execution searcher'
-    });
-  }
-
-  getImpact(userInput) {
-    const matches = userInput.value.match(invocationSearch);
-    if (matches) {
-      for (let i = 0; i < matches.length; i++) {
-        if (matches[i]) {
-          const call = FunctionCall.parse(matches[i]);
-          if (call && call.looksLikeValidArgumentExpression()) {
-            return SCORES.HIGH;
-          }
-        }
-      }
-    }
-    return SCORES.NONE;
-  }
-}
-
-module.exports = new NativeFunctionExecutionSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/no-alnum-searcher.js

@@ -1,50 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-
-const { SCORES } = common;
-const TERMS = {
-  MARKER_BEGINNING: '[][(!',
-  SIGNATURES: ['+[]', '![]', '+!+']
-};
-
-class NoAlnumSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description: 'Searches for non-alphanumeric exploits.',
-      id: 'CS-NOALNUM-1',
-      name: 'No al-num searcher'
-    });
-  }
-
-  getImpact(userInput) {
-    const markerIndex = userInput.value.indexOf(TERMS.MARKER_BEGINNING);
-    if (markerIndex < 0) {
-      return SCORES.NONE;
-    }
-
-    const stringAfterMarker = userInput.value.substring(markerIndex);
-    const foundSignatureTerm = TERMS.SIGNATURES.some(function(signature) {
-      return 0 <= stringAfterMarker.indexOf(signature);
-    });
-
-    return foundSignatureTerm ? SCORES.HIGH : SCORES.NONE;
-  }
-}
-
-module.exports = new NoAlnumSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/redefined-function-searcher.js

@@ -1,111 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-const Builder = require('../../../attack-patterns');
-
-const { SCORES } = common;
-const TERMS = {
-  CONCAT_OPERATOR: '+',
-  STATEMENT_TERMINATORS: ['\r', '\n', ';'],
-  DETECTION_FUNCTIONS: ['alert', 'confirm', 'prompt', 'eval']
-};
-
-const identifierSearch = Builder()
-  .JS()
-  .identifier()
-  .blockOrInlineComments()
-  .anyOf(['(`.*`', '\\(.*\\))'], true)
-  .build();
-//    =>
-//    (?:[a-zA-Z$_][0-9a-zA-Z$_]*)(?:\s*)(?:\/\*.*\*\/)?(?:\s*)(`.*`|\(.*\))
-
-const concatSearch = Builder({ flags: 'gm' })
-  .JS()
-  .concatenation()
-  .build();
-
-/**
- * Search for redefined function execution. This was meant to compensate
- * the vector in this vulnerability:
- *   const a = ${untrusted};
- * With the vectors:
- *   alert;a(1)
- *      or
- *   alert\na(1)
- */
-class RedefinedFunctionSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      description: 'Searches for redefined function execution.',
-      id: 'CS-REDEF-1',
-      name: 'Redefined function searcher'
-    });
-  }
-
-  getImpact(userInput) {
-    let impact;
-    let stringCopy;
-    const { value } = userInput;
-
-    // Prepare input string for examination
-    0 <= value.indexOf(TERMS.CONCAT_OPERATOR)
-      ? (stringCopy = value.replace(concatSearch, ''))
-      : (stringCopy = value);
-
-    // Look for function name, then a terminator, then a pattern match
-    TERMS.DETECTION_FUNCTIONS.some(function(fn) {
-      const fnIndex = stringCopy.indexOf(fn);
-      if (fnIndex < 0) {
-        return false;
-      }
-
-      const fnNextIndex = fnIndex + fn.length;
-
-      // Bail if match is at end of string or next char is not relevant
-      if (
-        stringCopy.length < fnNextIndex ||
-        /[a-zA-Z]/.test(stringCopy[fnNextIndex])
-      ) {
-        return false;
-      }
-
-      // Hereafter we look only at substring after function name
-      const stringAfterFn = stringCopy.substring(fnNextIndex);
-
-      // Set score and exit if there's a pattern match after terminator
-      return TERMS.STATEMENT_TERMINATORS.some(function(terminator) {
-        const terminatorIndex = stringAfterFn.indexOf(terminator);
-        if (terminatorIndex < 0) {
-          return false;
-        }
-
-        // Terminator found - score based on pattern match
-        if (0 <= stringAfterFn.search(identifierSearch, terminatorIndex)) {
-          impact = SCORES.HIGH;
-        } else {
-          impact = SCORES.LOW;
-        }
-        return true;
-      });
-    });
-
-    return impact || SCORES.NONE;
-  }
-}
-
-module.exports = new RedefinedFunctionSearcher();

package/lib/protect/rules/signatures/reflected-xss/custom-searchers/style-url-injection-searcher.js

@@ -1,65 +0,0 @@
-/**
-Copyright: 2023 Contrast Security, Inc
-  Contact: support@contrastsecurity.com
-  License: Commercial
-
-  NOTICE: This Software and the patented inventions embodied within may only be
-  used as part of Contrast Security’s commercial offerings. Even though it is
-  made available through public repositories, use of this Software is subject to
-  the applicable End User Licensing Agreement found at
-  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
-  between Contrast Security and the End User. The Software may not be reverse
-  engineered, modified, repackaged, sold, redistributed or otherwise used in a
-  way not consistent with the End User License Agreement.
-*/
-'use strict';
-
-const { CustomSearcher } = require('../../signature');
-const common = require('../../../common');
-
-const { SCORES } = common;
-const TERMS = {
-  EQUALS: '=',
-  STYLE: 'style',
-  URL: 'url'
-};
-
-const styleSearcher = RegExp(
-  'style\\s*=.*((url(?:\\s*)(?:\\/\\*.*\\*\\/)?(?:\\s*)\\(.*\\))|(background\\-image:\\\\\\d{4}))',
-  'i'
-);
-
-/**
- * Search for URL invocations via style/url() calls, like:
- *   <div style=content:url(...)>
- * @returns {CustomSearcher}
- */
-class StyleUrlInjectionSearcher extends CustomSearcher {
-  constructor() {
-    super({
-      name: 'StyleUrlInjectionSearcher',
-      id: 'CS-EVADE-STYLE',
-      description: 'Search for URL invocations via style/url() calls.'
-    });
-  }
-
-  getImpact(userInput, options) {
-    options = options || {};
-    const stringLower = (options.stringLower =
-      options.stringLower || userInput.value.toLowerCase());
-
-    const styleIndex = stringLower.indexOf(TERMS.STYLE);
-    if (styleIndex < 0) {
-      return SCORES.NONE;
-    }
-
-    const urlIndex = stringLower.indexOf(TERMS.URL, styleIndex + 5);
-    if (urlIndex < 0 || !styleSearcher.test(userInput.value)) {
-      return SCORES.NONE;
-    }
-
-    return SCORES.HIGH;
-  }
-}
-
-module.exports = new StyleUrlInjectionSearcher();