contrast-agent 3.8.4

data/lib/contrast/components/inventory.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module Inventory
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Specifically, this allows for querying the state of the Inventory
+      # product.
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        def enabled?
+          state.inventory_enabled?
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/logger.rb

@@ -0,0 +1,92 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module Logger
+      module InstanceMethods #:nodoc:
+        def logger
+          Contrast::Components::Logger::COMPONENT_INTERFACE
+        end
+      end
+      ClassMethods = InstanceMethods
+
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Specifically, this allows for querying the state of the Agent Logger.
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        %w[error? warn? info? debug?].each do |level|
+          define_method(level) { state.logger.send(level) }
+        end
+
+        # def trace? # TODO: RUBY-547
+        #  config&.agent&.logger&.level && config.agent.logger.level.to_s.casecmp('TRACE').to_i.zero?
+        # end
+
+        def error *args
+          log_with_level(*args, :error)
+        end
+
+        def warn *args
+          log_with_level(*args, :warn)
+        end
+
+        def info *args
+          log_with_level(*args, :info)
+        end
+
+        def debug *args
+          log_with_level(*args, :debug)
+        end
+
+        def with_level *args
+          log_with_level(*args)
+        end
+
+        def debug_with_time msg
+          ret = nil
+          a = Contrast::Utils::Timer.now_ms
+          ret = yield if block_given?
+          z = Contrast::Utils::Timer.now_ms
+          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
+          ret
+        end
+
+        # def trace_with_time msg # TODO: RUBY-547
+        #  ret = nil
+        #  unless trace?
+        #    ret = yield if block_given?
+        #    return ret
+        #  end
+        #
+        #  a = Contrast::Utils::Timer.now_ms
+        #  ret = yield if block_given?
+        #  z = Contrast::Utils::Timer.now_ms
+        #  log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
+        #  ret
+        # end
+
+        private
+
+        def log_with_level *args
+          if args.length == 2
+            msg, level = *args
+            state.cs__class.log_with_level(nil, msg, level)
+          elsif args.length == 3
+            exception, msg, level = *args
+            state.cs__class.log_with_level(exception, msg, level)
+          end
+
+          nil
+        rescue StandardError
+          nil
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/protect.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module Protect
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Specifically, this allows for querying the state of the Protect
+      # product.
+      class Interface
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :settings
+
+        def enabled?
+          state.protect_enabled?
+        end
+
+        def forcibly_disabled?
+          state.protect_forcibly_disabled?
+        end
+
+        def rules
+          SETTINGS.protect_rules
+        end
+
+        def rule name
+          SETTINGS.protect_rules[name]
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/sampling.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module Sampling
+      module Constants
+        DEFAULT_SAMPLING_ENABLED            = false
+        DEFAULT_SAMPLING_BASELINE           = 5
+        DEFAULT_SAMPLING_REQUEST_FREQUENCY  = 5
+        DEFAULT_SAMPLING_RESPONSE_FREQUENCY = 25
+        DEFAULT_SAMPLING_WINDOW_MS          = 180_000 # 3 minutes, arbitrary value from Java agent
+      end
+
+      module ClassMethods #:nodoc:
+        include Contrast::Components::ComponentBase
+        include Constants
+        include Contrast::Components::Interface
+
+        access_component :config
+
+        def sampling_control settings = @sampling_features
+          cas = CONFIG.root.assess&.sampling
+
+          {
+              enabled: [cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED] .reject(&:nil?).first,
+              baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE] .map(&:to_i).find(&:positive?),
+              request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY] .map(&:to_i).find(&:positive?),
+              response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
+              window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS] .map(&:to_i).find(&:positive?)
+          }
+        end
+      end
+
+      module InstanceMethods #:nodoc:
+        include Contrast::Components::ComponentBase
+        include Constants
+      end
+    end
+  end
+end

data/lib/contrast/components/scope.rb

@@ -0,0 +1,106 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'monitor'
+cs__scoped_require 'fiber'
+cs__scoped_require 'contrast/agent/scope'
+
+# This is the Scope component.
+#
+# It tracks /Contrast/ scope.  That is, "are we currently doing assess
+# or protect stuff within a patched method?" -- this is how we avoid doing
+# Contrast stuff on Contrast code.
+#
+# Separately from this component, there is also require scope, which is an
+# optimization on how we implement patching to `require`.
+module Contrast
+  module Components
+    module Scope # :nodoc:
+      MONITOR = Monitor.new
+      EXECUTION_CONTEXT = {} # rubocop:disable Style/MutableConstant
+
+      class Interface # :nodoc:
+        include Contrast::Components::ComponentBase
+
+        def initialize
+          # This is probably redundant with #scope_for_current_ec's nil check.
+          EXECUTION_CONTEXT[Fiber.current] = Contrast::Agent::Scope.new
+        end
+
+        # This returns the scope governing the current execution context.
+        # Use this sparingly, preferring the instance & class methods to
+        # access and query scope, rather than interacting with the scope
+        # object directly.
+        def scope_for_current_ec
+          MONITOR.synchronize do
+            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
+          end
+        end
+      end
+
+      module InstanceMethods # :nodoc:
+        # These scopes can be meta-defined (RUBY-573)
+        #
+        # [:my_cool_scope, :another_good_one].each do |scope|
+        #   define_method "in_#{scope}_scope?" do
+        #     abc
+        #   end
+        # end
+
+        def in_contrast_scope?
+          scope_for_current_ec.in_contrast_scope?
+        end
+
+        def enter_contrast_scope!
+          scope_for_current_ec.enter_scope_for Contrast::Agent::Scope::CONTRAST_SCOPE
+          scope_for_current_ec
+        end
+
+        def exit_contrast_scope!
+          scope_for_current_ec.exit_scope_for Contrast::Agent::Scope::CONTRAST_SCOPE
+          scope_for_current_ec
+        end
+
+        def with_contrast_scope
+          enter_contrast_scope!
+          yield
+        ensure
+          exit_contrast_scope!
+        end
+
+        def scope_for_current_ec
+          MONITOR.synchronize do
+            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
+          end
+        end
+
+        # TODO: https://contrast.atlassian.net/browse/RUBY-290
+        #
+        # Current behavior is to no-op if we're not "in a request context".
+        # Our C functions were previously checking to see if we had a scope, because
+        # scope was tacked on to a request context -- so "we have a scope, therefore,
+        # we have a request context."  We've decoupled scopes from request contexts,
+        # so now it checks "do we have a request context."
+        # RUBY-290 should remove all of that, including this method.
+        def in_request_context?
+          !!Contrast::Agent::REQUEST_TRACKER.current
+        end
+      end
+
+      def self.sweep_dead_ecs
+        # TODO: RUBY-571, #sweep_dead_ecs compensates for a lack of weak tables
+        # 'ec' for execution context.  in this case, it's a Fiber.
+        # Threads rely on Fibers, so two birds, one stone.
+        MONITOR.synchronize do
+          EXECUTION_CONTEXT.delete_if do |ec, _scope|
+            !ec.alive?
+          end
+        end
+      end
+
+      ClassMethods = InstanceMethods
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/settings.rb

@@ -0,0 +1,140 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    # This component encapsulates the statefulness of settings.
+    # When we say 'settings', we're referring specifically to external
+    # directives (likely provided by TeamServer) about product operation.
+    # 'Settings' is not a generic term for 'configurable stuff'.
+    module Settings
+      # This is a class.
+      class Interface
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :config
+
+        attr_reader :assess_rules,
+                    :protect_rules
+
+        # Other stateful information that doesn't yet cleanly fit anywhere:
+
+        # tainted_columns are database columns that receive unsanitized input.
+        # this statefulness
+        attr_reader :tainted_columns # This can probably go into assess_state?
+
+        # a vulnerability like padding oracle is exploited across
+        # multiple requests, as a timing attack.  these attempts must be
+        # accumulated, in order to recognize the pattern and block the attack.
+        attr_reader :accumulator_settings
+
+        # These three 'state' variables represent atomic config/setting state,
+        # outside of things like rule defs.
+
+        def assess_state
+          @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
+              enabled: false,
+              sampling_features: nil
+          }
+        end
+
+        def protect_state
+          @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
+              enabled: false,
+              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
+          }
+        end
+
+        def application_state
+          @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
+              modes_by_id: Hash.new(:NO_ACTION),
+              exclusion_matchers: [],
+              disabled_assess_rules: []
+          }
+        end
+
+        # These are settings that we receive & store.
+        # Rules are settings too, but they're more involved.
+        # So, between this block and rules, that's setting state.
+        PROTECT_STATE_ATTRS       = %i[].cs__freeze
+        ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
+        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
+        STATE_ATTRS               = PROTECT_STATE_ATTRS | ASSESS_STATE_ATTRS | APPLICATION_STATE_ATTRS
+
+        # Meta-define an accessor for each state attribute.
+        begin
+          PROTECT_STATE_ATTRS.each do |attr|
+            define_method(attr) do
+              protect_state[attr]
+            end
+          end
+
+          ASSESS_STATE_ATTRS.each do |attr|
+            define_method(attr) do
+              assess_state[attr]
+            end
+          end
+
+          APPLICATION_STATE_ATTRS.each do |attr|
+            define_method(attr) do
+              application_state[attr]
+            end
+          end
+        end
+
+        def initialize
+          reset_state
+        end
+
+        # Wipe state to zero.
+        def reset_state
+          @assess_rules = {}
+          @protect_rules = {}
+
+          @tainted_columns = {}
+
+          @assess_state = nil
+          @protect_state = nil
+          @application_state = nil
+        end
+
+        def build_assess_rules
+          @assess_rules = {}
+
+          Contrast::Agent::Assess::Rule::Csrf.new
+          Contrast::Agent::Assess::Rule::Redos.new
+        end
+
+        def build_protect_rules
+          @protect_rules = {}
+
+          # rules
+          Contrast::Agent::Protect::Rule::CmdInjection.new
+          Contrast::Agent::Protect::Rule::Deserialization.new
+          Contrast::Agent::Protect::Rule::HttpMethodTampering.new
+          Contrast::Agent::Protect::Rule::NoSqli.new
+          Contrast::Agent::Protect::Rule::PathTraversal.new
+          Contrast::Agent::Protect::Rule::Sqli.new
+          Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
+          Contrast::Agent::Protect::Rule::Xss.new
+          Contrast::Agent::Protect::Rule::Xxe.new
+
+          # Beta Rules
+          Contrast::Agent::Protect::Rule::Csrf.new
+        end
+
+        def protect_rule name
+          @protect_rules[name]
+        end
+
+        # these are less 'settings' and more 'how do I behave.'
+        # relocate to Agent or Assess/Protect.
+        def protect_rule_mode rule_id
+          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/config.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  # This is the base module for our configuration classes. It is intended to
+  # facilitate the translation of the Common Configuration settings to usable
+  # Ruby classes. Any class under this namespace should be required here,
+  # providing a single point of require for this functionality.
+  module Config
+  end
+end
+
+cs__scoped_require 'contrast/config/base_configuration'
+cs__scoped_require 'contrast/config/default_value'
+
+cs__scoped_require 'contrast/config/logger_configuration'
+
+cs__scoped_require 'contrast/config/heap_dump_configuration'
+cs__scoped_require 'contrast/config/service_configuration'
+cs__scoped_require 'contrast/config/exception_configuration'
+cs__scoped_require 'contrast/config/assess_rules_configuration'
+cs__scoped_require 'contrast/config/protect_rule_configuration'
+cs__scoped_require 'contrast/config/protect_rules_configuration'
+cs__scoped_require 'contrast/config/sampling_configuration'
+
+cs__scoped_require 'contrast/config/ruby_configuration'
+cs__scoped_require 'contrast/config/agent_configuration'
+cs__scoped_require 'contrast/config/application_configuration'
+cs__scoped_require 'contrast/config/server_configuration'
+cs__scoped_require 'contrast/config/assess_configuration'
+cs__scoped_require 'contrast/config/inventory_configuration'
+cs__scoped_require 'contrast/config/protect_configuration'
+cs__scoped_require 'contrast/config/root_configuration'