contrast-agent 3.8.4

data/lib/contrast/config/sampling_configuration.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # sampling functionality of the Agent.
+    class SamplingConfiguration < BaseConfiguration
+      KEYS = {
+          enable: EMPTY_VALUE,
+          baseline: EMPTY_VALUE,
+          request_frequency: EMPTY_VALUE,
+          response_frequency: EMPTY_VALUE,
+          window_ms: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/server_configuration.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # server identification functionality of the Agent.
+    class ServerConfiguration < BaseConfiguration
+      KEYS = {
+          name: EMPTY_VALUE,
+          path: EMPTY_VALUE,
+          type: EMPTY_VALUE,
+          tags: EMPTY_VALUE,
+          environment: EMPTY_VALUE,
+          version: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/service_configuration.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # communication between the Agent & the Service.
+    class ServiceConfiguration < BaseConfiguration
+      KEYS = {
+          enable: EMPTY_VALUE,
+          host: EMPTY_VALUE,
+          port: EMPTY_VALUE,
+          socket: EMPTY_VALUE,
+          logger: Contrast::Config::LoggerConfiguration
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/configuration.rb

@@ -0,0 +1,214 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'yaml'
+cs__scoped_require 'fileutils'
+
+cs__scoped_require 'contrast/config'
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  # This is how we read in the local settings for the Agent, both ENV/ CMD line
+  # and from properties files, in order to determine which settings, if any,
+  # the user has overridden.
+  class Configuration
+    extend Forwardable
+
+    include Contrast::Components::Interface
+
+    access_component :scope
+
+    def_delegator :root, :assign_value_to_path_array
+
+    attr_reader :default_name, :root
+
+    DEFAULT_YAML_PATH  = 'contrast_security.yaml'
+    DEFAULT_HOST       = '127.0.0.1'
+    DEFAULT_PORT       = '30555'
+    MILLISECOND_MARKER = '_ms'
+    CONVERSION = {
+        'agent.service.enable' => 'agent.start_bundled_service'
+    }.cs__freeze
+    CONFIG_BASE_PATHS = [
+      '',
+      'config/',
+      '/etc/contrast/ruby/',
+      '/etc/contrast/',
+      '/etc/'
+    ].cs__freeze
+    REMOVE_FIELDS = [
+      'contrast'
+    ].cs__freeze
+
+    def initialize cli_options = nil, default_name = DEFAULT_YAML_PATH
+      @default_name = default_name
+
+      # Load config_kv from file
+      config_kv = deep_stringify_all_keys(load_config)
+
+      # Overlay CLI options - they take precedence over config file
+      cli_options = deep_stringify_all_keys(cli_options)
+      config_kv = deep_merge(cli_options, config_kv) if cli_options
+
+      # Some in-flight rewrites to maintain backwards compatibility
+      config_kv = update_prop_keys(config_kv)
+      config_kv = deprecate_fields(config_kv)
+
+      @root = Contrast::Config::RootConfiguration.new(config_kv)
+    end
+
+    # Because we call this method to determine the need for scoping, it itself
+    # must be executed inside a Contrast scope. Failure to do so could result
+    # in an infinite loop on the to_sym method used later.
+    def method_missing symbol, *args
+      with_contrast_scope do
+        begin
+          root.public_send(symbol, *args)
+        rescue NoMethodError => _e
+          super
+        end
+      end
+    end
+
+    def respond_to_missing? method_name, *args
+      root&.cs__respond_to?(method_name) || super
+    end
+
+    protected
+
+    # TODO: RUBY-546 move utility methods to auxiliary classes
+
+    def load_config
+      config = {}
+      configuration_paths.find do |path|
+        found = File.exist?(path)
+        next unless found
+
+        readable = File.readable?(path)
+        unless readable
+          puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
+          next
+        end
+        config = yaml_to_hash(path)
+        break
+      end
+
+      if config.empty?
+        puts "!!! Contrast - working directory: #{ Dir.pwd }"
+        puts '!!! Contrast - configuration file could not be found at any of the search paths'
+        puts 'Valid configuration paths are: '
+        configuration_paths.each do |path|
+          puts(path)
+        end
+      end
+      config
+    end
+
+    def yaml_to_hash path
+      if path && File.readable?(path)
+        begin
+          yaml = IO.read(path)
+          yaml = ERB.new(yaml).result if defined?(ERB)
+          return YAML.safe_load(yaml)
+        rescue RuntimeError => e
+          puts "ERROR: unable to load configuration from path due to #{ e }"
+          puts "ERROR: path=#{ path } pwd=#{ Dir.pwd }"
+        end
+      end
+
+      {}
+    end
+
+    # We're updating properties loaded from the configuration
+    # files to match the new agreed upon standard configuration
+    # names, so that one file works for all agents
+    def update_prop_keys config
+      converted = false
+      CONVERSION.each_pair do |old_method, new_method|
+        # See if the old value was set and needs to be translated
+        deprecated_keys = old_method.split('.')
+
+        old_value = config
+        deprecated_keys.each do |key|
+          old_value = old_value[key]
+          break if old_value.nil?
+        end
+
+        next if old_value.nil?
+
+        converted = true
+
+        puts "The deprecated property #{ old_method } is being set."
+        puts "Please update your config to use the property #{ new_method } instead."
+
+        new_keys = new_method.split('.')
+
+        # We changed the seconds values into ms values. Multiply them accordingly
+        old_value = old_value.to_i * 1000 if new_method.end_with?(MILLISECOND_MARKER)
+
+        new_value = config
+        end_idx = new_keys.length - 1
+        new_keys.each_with_index do |new_key, index|
+          if index == end_idx
+            new_value[new_key] = old_value if new_value[new_key].nil?
+          else
+            new_value = {} if new_value.nil?
+            new_value[new_key] = {} if new_value[new_key].nil?
+            new_value = new_value[new_key]
+          end
+        end
+      end
+
+      config
+    end
+
+    def deprecate_fields hash
+      REMOVE_FIELDS.each do |field|
+        path = field.split('.')
+        active_path = hash
+        path.each_with_index do |delete_path, index|
+          if index == path.length - 1 && active_path
+            active_path.delete(delete_path)
+          elsif active_path
+            active_path = active_path[delete_path]
+          end
+        end
+      end
+      hash
+    end
+
+    # Base paths to check for the contrast configuration file, sorted by
+    # reverse order of precedence (first is most important).
+    def configuration_paths
+      @_configuration_paths ||= begin
+        basename = default_name.split('.').first
+        names = %w[yml yaml].map { |suffix| "#{ basename }.#{ suffix }" }
+
+        paths = []
+        paths << ENV['CONTRAST_CONFIG_PATH']     if ENV['CONTRAST_CONFIG_PATH']
+        paths << ENV['CONTRAST_SECURITY_CONFIG'] if ENV['CONTRAST_SECURITY_CONFIG']
+
+        tmp = CONFIG_BASE_PATHS.product(names)
+        paths += tmp.map!(&:join)
+        paths
+      end
+    end
+
+    def deep_merge cli_config, file_config
+      cli_config.merge(file_config) do |_key, cli_value, file_value|
+        cli_value.is_a?(Hash) && file_value.is_a?(Hash) ? deep_merge(cli_value, file_value) : cli_value
+      end
+    end
+
+    def deep_stringify_all_keys hash
+      return if hash.nil?
+
+      new_hash = {}
+      hash.each do |key, value|
+        new_hash[key.to_s] = value.is_a?(Hash) ? deep_stringify_all_keys(value) : value
+      end
+      new_hash
+    end
+  end
+end

data/lib/contrast/core_extensions/assess.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module CoreExtensions
+    # Our top level Protect namespace in the Core Extensions section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    # @deprecated This is one of our earliest designs and is not nearly as
+    #   relevant given the move to C based patching and the lessons learned
+    #   therein.
+    module Assess
+      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+
+      cs__scoped_require 'contrast/utils/tag_util'
+
+      # provider rules - have to come before policy
+      cs__scoped_require 'contrast/agent/assess/rule/provider'
+
+      # tagging / dataflow
+      cs__scoped_require 'contrast/agent/assess/adjusted_span'
+      cs__scoped_require 'contrast/agent/assess/policy/policy_node'
+      cs__scoped_require 'contrast/agent/assess/policy/source_node'
+      cs__scoped_require 'contrast/agent/assess/policy/source_method'
+      cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
+      cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
+      cs__scoped_require 'contrast/agent/assess/policy/trigger_node'
+      cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+      cs__scoped_require 'contrast/agent/assess/policy/policy'
+      cs__scoped_require 'contrast/agent/assess/policy/patcher'
+
+      # classes that don't play nice w/ our standard propagation
+      cs__scoped_require 'contrast/agent/assess/frozen_properties'
+      cs__scoped_require 'contrast/core_extensions/assess/assess_extension'
+      # this needs to come first b/c array and others work on strings and
+      # expect them to be trackable
+      cs__scoped_require 'contrast/core_extensions/assess/string'
+
+      cs__scoped_require 'contrast/core_extensions/assess/array'
+      cs__scoped_require 'contrast/core_extensions/assess/erb'
+      cs__scoped_require 'contrast/core_extensions/assess/fiber'
+      cs__scoped_require 'contrast/core_extensions/assess/hash'
+      cs__scoped_require 'contrast/core_extensions/assess/kernel'
+      cs__scoped_require 'contrast/core_extensions/assess/regexp'
+      cs__scoped_require 'contrast/core_extensions/assess/module'
+      cs__scoped_require 'contrast/core_extensions/assess/basic_object'
+      cs__scoped_require 'contrast/core_extensions/assess/tilt_template_trigger'
+    end
+  end
+end

data/lib/contrast/core_extensions/assess/array.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/components/interface'
+
+# This is our patch of the Array class required to handle propagation
+# Disclaimer: there may be a better way, but we're in a 'get it work' state.
+# Hopefully, we'll be in a 'get it right' state soon.
+class Array
+  include Contrast::Components::Interface
+
+  access_component :scope
+
+  ARRAY_JOIN_HASH = {
+      'class_name' => 'Array',
+      'instance_method' => true,
+      'method_visibility' => 'public',
+      'method_name' => 'join',
+      'action' => 'CUSTOM',
+      'source' => 'O',
+      'target' => 'R',
+      'patch_class' => 'NOOP',
+      'patch_method' => '__cs_track_join'
+  }.cs__freeze
+  ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
+
+  # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+  # Multiple Strings are appended with the #join method. Because that
+  # operation happens in C, we have to do it here rather than rely on the
+  # patch of our String append or concat methods.
+  def __cs_track_join separator, ret
+    return ret if Contrast::Agent::Patching::Policy::Patcher.skip_assess_analysis?
+
+    with_contrast_scope do
+      shift = 0
+      separator_length = separator.nil? ? 0 : separator.to_s.length
+      each do |obj|
+        if obj # skip nil here
+          ret.cs__copy_from(obj, shift)
+          shift += obj.to_s.length
+        end
+        shift += separator_length
+      end
+      return ret unless ret.cs__tracked?
+
+      ret.cs__properties.cleanup_tags
+      ret.cs__properties.build_event(
+          ARRAY_JOIN_NODE,
+          ret,
+          self,
+          ret,
+          [separator])
+      ret
+    end
+  end
+end
+cs__scoped_require 'cs__assess_array/cs__assess_array'

data/lib/contrast/core_extensions/assess/assess_extension.rb

@@ -0,0 +1,145 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/properties'
+cs__scoped_require 'contrast/agent/assess/frozen_properties'
+cs__scoped_require 'contrast/agent/assess/insulator'
+
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This module is responsible for maintaining the data we need to
+      # construct a trace event for the object in which it is included. Rather
+      # than have this code all over the place, any class that wants to use
+      # dataflow features should be sent
+      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
+      module AssessExtension
+        include Contrast::Utils::ScopeUtil
+
+        # Lazily build properties object. Only objects that have been tracked
+        # will have the @_cs__properties, but all will respond to the
+        # cs__properties method call. You should only call this method if you
+        # either intend to start tracking an object or you have already checked
+        # cs__tracked? and it is true.
+        def cs__properties
+          # If this object was tracked before being frozen, it'll have
+          # mutable properties we need inside of the insulator @_cs__properties
+          if cs__frozen?
+            if instance_variable_defined?(:@_cs__properties)
+              @_cs__properties.properties
+            else
+              Contrast::Agent::Assess::Insulator.generate_frozen.properties
+            end
+          else
+            @_cs__properties ||= Contrast::Agent::Assess::Insulator.generate
+            @_cs__properties.properties
+          end
+        end
+
+        def cs__properties?
+          instance_variable_defined?(:@_cs__properties)
+        end
+
+        # This is a way to check if we are already tracking an object without
+        # adding tracking to it. If the object already has been tracked we will
+        # return the tracking state of its properties. If the object hasn't
+        # already been tracked we will return false without starting to track
+        # it
+        def cs__tracked?
+          cs__properties? && cs__properties.tracked?
+        end
+
+        def cs__reset_properties
+          return unless cs__properties?
+
+          @_cs__properties = nil
+        end
+
+        # copy tags and info from object to self if object support methods
+        # obj: the object from which to copy tags and events
+        # shift: how far to shift the tags, negative moves left
+        # skip_tags: array of tags to skip copying
+        def cs__copy_from obj, shift = 0, skip_tags = nil
+          return if obj.equal?(self)
+          return unless Contrast::Utils::DuckUtils.quacks_to?(obj,
+                                                              :cs__tracked?)
+          return unless obj.cs__tracked?
+          return if cs__properties == Contrast::Agent::Assess::Insulator.generate_frozen.properties
+
+          # This was fun to find...
+          # the clone and dup methods don't apply to instance variables in the
+          # cloned/ duped thing, so the arrays in the properties were the same.
+          # The most infinite of infinite loops ensued.
+          # DO NOT TAKE THIS OUT!
+          cs__reset_properties if obj.cs__properties == cs__properties
+
+          obj.cs__properties.events.each do |event|
+            cs__properties.events << event
+          end
+
+          obj.cs__properties.tag_keys.each do |key|
+            next if skip_tags&.include?(key)
+
+            new_tags = []
+            value = obj.cs__properties.fetch_tag(key)
+            value.each do |tag|
+              new_tags << tag.copy_modified(shift)
+            end
+            existing = cs__properties.fetch_tag(key)
+            if existing
+              existing.concat(new_tags)
+            else
+              cs__properties.set_tags(key, new_tags)
+            end
+          end
+        end
+
+        # Some propagation occurred, but we're not sure what the
+        # exact transformation was. To be safe, we just explode
+        # all the tags from the source to the return.
+        #
+        # If the return already had that tag, the existing tag
+        # range is recycled to save us an object.
+        def cs__splat_tags ret, source = self
+          return unless Contrast::Utils::DuckUtils.quacks_to?(
+              ret,
+              :cs__tracked?)
+
+          splat_source = Contrast::Utils::DuckUtils.quacks_to?(
+              source,
+              :cs__tracked?)
+          splat_source &&= source.cs__tracked?
+          if splat_source
+            length = Contrast::Utils::StringUtils.ret_length(ret)
+            source.cs__properties.tag_keys.each do |key|
+              existing = ret.cs__properties.fetch_tag(key)
+              # if the tag already exists, drop all but the first range
+              # then change that range to cover the entire return
+              if existing
+                existing.drop(existing.length - 1)
+                range = existing[0]
+                range.repurpose(0, length)
+              else
+                span = Contrast::Agent::Assess::AdjustedSpan.new(0, length)
+                ret.cs__properties.add_tag(key, span)
+              end
+            end
+          end
+          return unless ret.cs__tracked?
+
+          length ||= Contrast::Utils::StringUtils.ret_length(ret)
+          ret.cs__properties.tag_keys.each do |key|
+            next unless key
+
+            existing = ret.cs__properties.fetch_tag(key)
+            next unless existing
+
+            existing.each do |range|
+              range.update_end(length) if range.end_idx > length
+            end
+          end
+        end
+      end
+    end
+  end
+end