Class: Contrast::Agent::Protect::Rule::CmdiBaseRule

Inherits:
Base
  • Object
show all
Includes:
Reporting::InputType, Components::Logger::InstanceMethods
Defined in:
lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb

Overview

The Ruby implementation of the Protect Command Injection Semantic Dangerous Path sub-rule. This rule should report

Constant Summary collapse

CHAINED_COMMAND_CHARS = 
/[;&|<>]/.cs__freeze
APPLICABLE_USER_INPUTS = 
[
  BODY, COOKIE_VALUE, HEADER, PARAMETER_NAME,
  PARAMETER_VALUE, JSON_VALUE, MULTIPART_VALUE,
  MULTIPART_FIELD_NAME, XML_VALUE, DWR_VALUE, UNKNOWN
].cs__freeze

Constants included from Reporting::InputType

Reporting::InputType::BODY, Reporting::InputType::COOKIE_NAME, Reporting::InputType::COOKIE_VALUE, Reporting::InputType::DWR_VALUE, Reporting::InputType::HEADER, Reporting::InputType::JSON_ARRAYED_VALUE, Reporting::InputType::JSON_VALUE, Reporting::InputType::METHOD, Reporting::InputType::MULTIPART_CONTENT_TYPE, Reporting::InputType::MULTIPART_FIELD_NAME, Reporting::InputType::MULTIPART_NAME, Reporting::InputType::MULTIPART_VALUE, Reporting::InputType::PARAMETER_NAME, Reporting::InputType::PARAMETER_VALUE, Reporting::InputType::QUERYSTRING, Reporting::InputType::REQUEST, Reporting::InputType::SOCKET, Reporting::InputType::UNDEFINED_TYPE, Reporting::InputType::UNKNOWN, Reporting::InputType::URI, Reporting::InputType::URL_PARAMETER, Reporting::InputType::XML_VALUE

Constants inherited from Base

Base::BLOCKING_MODES, Base::RULE_NAME, Base::STACK_COLLECTION_RESULTS, Base::SUSPICIOUS_REPORTING_RULES

Constants included from Filters

Filters::POSTFILTER_MODES

Instance Attribute Summary

Attributes inherited from Base

#mode

Instance Method Summary collapse

Methods included from Reporting::InputType

to_a

Methods included from Components::Logger::InstanceMethods

#cef_logger, #logger

Methods inherited from Base

#append_to_activity, #block_message, #cef_logging, #classify, #enabled?, #excluded?, #initialize, #rule_name, #stream_safe?, #sub_rules, #update

Methods included from Filters

#infilter?, #postfilter, #postfilter?, #prefilter, #prefilter?

Methods included from Builders

#build_attack_result, #build_attack_without_match, #build_base_sample, #build_violation

Methods included from Components::Scope::InstanceMethods

#contrast_enter_method_scopes!, #contrast_exit_method_scopes!, #with_app_scope, #with_contrast_scope, #with_deserialization_scope, #with_split_scope

Constructor Details

This class inherits a constructor from Contrast::Agent::Protect::Rule::Base

Instance Method Details

#build_attack_with_match(context, input_analysis_result, result, candidate_string, **kwargs) ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb', line 53

def build_attack_with_match(context,
                            input_analysis_result,
                            result,
                            candidate_string,
                            **kwargs)
  return result if mode == :NO_ACTION || mode == :PERMIT

  result ||= build_attack_result(context)
  update_successful_attack_response(context, input_analysis_result, result, candidate_string)
  append_sample(context, input_analysis_result, result, candidate_string, **kwargs)
  result
end

#classification ⇒ module<Contrast::Agent::Protect::Rule::CmdiInputClassification>

CMDI input classification

Returns:



29
30
31
 
# File 'lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb', line 29

def classification
  @_classification ||= Contrast::Agent::Protect::Rule::CmdiInputClassification.cs__freeze
end

#infilter(context, classname, method, command) ⇒ Object

CMDI Semantic infilter: This rule does not have input classification. If a value matches the CMDI applicable input types and it’s length is > 2 we can check if it’s used as command backdoors.

to BLOCK and valid cdmi is detected.

Parameters:

Raises:



44
45
46
47
48
49
50
51
 
# File 'lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb', line 44

def infilter context, classname, method, command
  return unless infilter?(command)
  return unless (result = build_violation(context, command))

  append_to_activity(context, result)
  record_triggered(context)
  raise_error(classname, method) if blocked_violation?(result)
end