Sha256: e22d4649996b367105d9674540889de5f0bf0a094cd72016f8771d806ff89347

Contents?: true

Size: 1.43 KB

Versions: 16

Compression:

Stored size: 1.43 KB

Contents

# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/agent/assess/policy/source_method'

module Contrast
  module Agent
    module Assess
      module Policy
        module SourceValidation
          # Validator used to assert a CROSS_SITE tag is actually applicable to the given method before applying the
          # tag to its target
          module CrossSiteValidator
            # Prevent the application of a tag if it is from a source known to not apply a tag in a provided context.
            # Note that for Rack, the Header will be HTTP_REFERER. Rails does some help in
            # ActionDispatch::Http::Headers to convert keys like `referer` to `HTTP_REFERER` before they get to the
            # Rack::Request#get_header method
            # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
            def self.valid? tag, source_type, source_name
              return true unless tag == 'CROSS_SITE'
              return false if source_type == Contrast::Agent::Assess::Policy::SourceMethod::HEADER_KEY_TYPE
              return true unless source_type == Contrast::Agent::Assess::Policy::SourceMethod::HEADER_TYPE
              return false unless source_name

              source_name == 'HTTP_REFERER'
            end
          end
        end
      end
    end
  end
end

Version data entries

16 entries across 16 versions & 1 rubygems

Version Path
contrast-agent-7.5.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.4.1 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.4.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.3.2 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.3.1 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.3.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.2.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.1.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-7.0.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.15.3 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.15.2 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.15.1 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.15.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.14.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.13.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
contrast-agent-6.12.0 lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb