cmd_injection.rb in contrast-agent-6.8.0

- old
+ new

@@ -4,10 +4,13 @@
 require 'contrast/agent/protect/rule/base_service'
 require 'contrast/utils/stack_trace_utils'
 require 'contrast/utils/object_share'
 require 'contrast/components/logger'
 require 'contrast/agent/reporting/input_analysis/input_type'
+require 'contrast/agent_lib/interface'
+require 'contrast/agent/protect/rule/cmdi/cmdi_chained_command'
+require 'contrast/agent/protect/rule/cmdi/cmdi_dangerous_path'
 require 'contrast/agent/protect/rule/cmdi/cmdi_base_rule'
 require 'contrast/agent/protect/rule/cmdi/cmdi_backdoors'
 
 module Contrast
   module Agent
@@ -16,17 +19,31 @@
         # The Ruby implementation of the Protect Command Injection rule.
         class CmdInjection < Contrast::Agent::Protect::Rule::CmdiBaseRule
           include Contrast::Components::Logger::InstanceMethods
           include Contrast::Agent::Reporting::InputType
           NAME = 'cmd-injection'
-          SUB_RULES = [Contrast::Agent::Protect::Rule::CmdiBackdoors.new].cs__freeze
 
+          APPLICABLE_USER_INPUTS = [
+            BODY, COOKIE_VALUE, HEADER, PARAMETER_NAME,
+            PARAMETER_VALUE, JSON_VALUE, MULTIPART_VALUE,
+            MULTIPART_FIELD_NAME, XML_VALUE, DWR_VALUE
+          ].cs__freeze
+          SUB_RULES = [
+            Contrast::Agent::Protect::Rule::CmdiBackdoors.new,
+            Contrast::Agent::Protect::Rule::CmdiChainedCommand.new,
+            Contrast::Agent::Protect::Rule::CmdiDangerousPath.new
+          ].cs__freeze
+
           def rule_name
             NAME
           end
 
           def sub_rules
             SUB_RULES
+          end
+
+          def applicable_user_inputs
+            APPLICABLE_USER_INPUTS
           end
 
           # CMDI infilter:
           #
           # @param context [Contrast::Agent::RequestContext] current request context