Protect rules
Apply Protect rules to monitor or block specific kinds of attacks in application environments. Every rule represents a type of attack that exploits vulnerabilities in either custom code or open-source libraries, such as SQL injection or cross-site scripting.
Contrast includes many ADR rules you can use to monitor or block attacks, like these:
Class Loader Manipulation: Verifies that reflection APIs are not used to retrieve an instance of a class loader.
Command injection: Carefully crafted inputs can execute tainted operating system-level commands.
Cross-site scripting: A web application vulnerability that can allow users to run arbitrary JavaScript in other user's browsers.
Expression language injection: A vulnerability type for many frameworks and custom code that happens when an application mistakenly evaluates user inputs as expression languages like OGNL, SpEL, or JSP EL.
JNDI Injection: Marks cases where the PROVIDER_URL for a JNDI lookup is changed between the instantiation of the InitialContext and when the lookup is performed, specifically when the URL is controlled by the user.
Method tampering: An attack against authentication or authorization systems that have implicit "allow all" settings in their security configuration.
OGNL Injection: Carefully crafted inputs can alter the OGNL expressions the application executes, and steal data or execute code.
Path traversal / Local file include: A vulnerability that allows users to control which files an application opens and reads.
Server-Side JavaScript Injection: Carefully crafted inputs can execute arbitrary code when evaluated.
Signature Tampering: Verifies that nothing tampered with an elliptic curve digital signature algorithm (ECDSA) signature.
SQL and NoSQL injection: Carefully crafted inputs to the application that alter SQL or NoSQL queries to steal data or execute code.
Unsafe file upload: A vulnerability in the upload process that allows malicious files to bypass upload protections and perform malicious actions. This rule affects files with commonly-used extensions including (but not limited to): SVG, ASP, ASPX, *SH, JAR, and JAVA. In Monitor mode, this rule reports potentially unsafe file uploads to Contrast. In Block mode, Contrast blocks uploads of these files.
Untrusted deserialization: A web application vulnerability that allows users to pass arbitrary objects to a deserializer and execute remote code.
XML external entity processing: A vulnerability in XML processing that allows users to read, write, and potentially execute remote code to a file.
Zip File Overwrite: A vulnerability that uses directory backtracking while a file is being unzipped. This type of vulnerability is used to create or overwrite a file outside the directory that is allowed via an insecure unzipping tool.