contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/agent/static_analysis.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/gemfile_reader'
+cs__scoped_require 'contrast/api/decorators/application_update'
+
+module Contrast
+  module Agent
+    # this module handles one time static analysis tasks
+    class StaticAnalysis
+      include Singleton
+      include Contrast::Components::Interface
+      access_component :logging, :analysis, :scope
+      class << self
+        # After the first request is complete, we do a one-time manual catchup to review and
+        # report the already-loaded gems.
+        def catchup
+          @_catchup ||= begin
+                          with_contrast_scope do
+                            Contrast::Utils::GemfileReader.instance.map_loaded_classes
+                            send_inventory_message
+                            true
+                          end
+                        end
+        rescue StandardError => e
+          logger.warn('Unable to run post-initialization static analysis', e)
+        end
+
+        def send_inventory_message
+          return unless INVENTORY.enabled?
+
+          app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
+
+          Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
+          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(app_update_msg)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/thread.rb

@@ -9,7 +9,7 @@ module Contrast
     class Thread < ::Thread
       include Contrast::Components::Interface
 
-      access_component :logging, :scope
+      access_component :scope
 
       # Make our internal code run in Contrast scope.
       def initialize *args

data/lib/contrast/agent/tracepoint_hook.rb

@@ -12,10 +12,6 @@ module Contrast
       access_component :logging, :scope
 
       class << self
-        def active?
-          instance_variable_defined?(:@require_hook) && @require_hook.enabled?
-        end
-
         def enable!
           @require_hook ||= TracePoint.new(:end) do |tracepoint_event|
             process(tracepoint_event)
@@ -33,7 +29,7 @@ module Contrast
 
         def process tracepoint_event
           with_contrast_scope do
-            logger.debug("Received end event for #{ tracepoint_event.self }")
+            logger.trace('Received TracePoint end event', module: tracepoint_event.self.to_s)
 
             loaded_module = tracepoint_event.self
             path = tracepoint_event.path

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.10.1'
+    VERSION = '3.12.2'
   end
 end

data/lib/contrast/api.rb

@@ -12,7 +12,7 @@ end
 
 cs__scoped_require 'contrast/api/dtm_pb'
 cs__scoped_require 'contrast/api/settings_pb'
-cs__scoped_require 'contrast/delegators'
+cs__scoped_require 'contrast/api/decorators'
 cs__scoped_require 'contrast/api/unix_socket'
 cs__scoped_require 'contrast/api/tcp_socket'
 cs__scoped_require 'contrast/api/speedracer'

data/lib/contrast/api/decorators.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to decorate protobuf models
+    module Decorators
+    end
+  end
+end
+cs__scoped_require 'contrast/api/decorators/application_update'
+cs__scoped_require 'contrast/api/decorators/input_analysis'
+cs__scoped_require 'contrast/api/decorators/application_settings'
+cs__scoped_require 'contrast/api/decorators/server_features'

data/lib/contrast/api/decorators/application_settings.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationSettings protobuf model to handle setting translation
+      module ApplicationSettings
+        MODE_ALLOWLIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        # Convert protobuf exlcusions into Agent exclusions
+        def translated_exclusions
+          exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
+        end
+
+        # Convert protobuf protect rule settings into a hash that settings state understands
+        def translated_protection_mode_by_id
+          protection_rules = self.protection_rules.map { |pr, _hash| [pr.id, pr.mode] } # [[RULE_ID, MODE]]
+          protection_rules.select! { |(_id, mode)| MODE_ALLOWLIST.include? mode } # [REMOVE IF MODE INVALID]
+          protection_rules.to_h # {RULE_ID => MODE}
+        end
+
+        def application_state_translation
+          {
+              modes_by_id: translated_protection_mode_by_id,
+              exclusion_matchers: translated_exclusions,
+              disabled_assess_rules: disabled_assess_rules,
+              session_id: Contrast::Utils::StringUtils.force_utf8(session_id)
+          }
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::ApplicationSettings.include(Contrast::Api::Decorators::ApplicationSettings)

data/lib/contrast/api/decorators/application_update.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
+      # AppUpdate dtm
+      module ApplicationUpdate
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_view_technology_descriptor_data view_technology_descriptors
+          view_technology_descriptors.each do |vtd|
+            vtd.technology_names.each do |tech_name|
+              technologies[tech_name] = true
+            end
+          end
+        end
+
+        def append_library_update library_dtm_list, library_tags
+          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+          library_dtm_list.each do |library_dtm|
+            library_dtm.tags = lib_tags
+            libraries[library_dtm.hash_code] = library_dtm
+          end
+        end
+
+        # TS only allows you to report 500 routes per application
+        def append_route_coverage_data route_coverage_dtms
+          route_coverage_dtms.take(500).each do |route_coverage_dtm|
+            routes << route_coverage_dtm
+          end
+        end
+
+        def append_platform_version platform_version
+          self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
+          platform.major = platform_version.major
+          platform.minor = platform_version.minor
+          platform.build = platform_version.patch
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build
+            msg = new
+            msg.append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies)
+            msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
+            msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
+            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)

data/lib/contrast/api/decorators/input_analysis.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      module InputAnalysis
+        attr_accessor :request
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::InputAnalysis.include(Contrast::Api::Decorators::InputAnalysis)

data/lib/contrast/api/decorators/server_features.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      module ServerFeatures
+        # 'defend' is legacy for 'protect' in the dtm.
+        def protect_enabled?
+          !!defend.enabled
+        end
+
+        def assess_enabled?
+          !!assess.enabled
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::ServerFeatures.include(Contrast::Api::Decorators::ServerFeatures)

data/lib/contrast/api/speedracer.rb

@@ -12,14 +12,13 @@ module Contrast
     # to manage the bundled Service.
     class Speedracer
       include Contrast::Components::Interface
-      access_component :logging, :contrast_service, :app_context
+      access_component :app_context, :contrast_service, :logging
 
       attr_reader :client_number,
                   :host,
                   :port,
                   :socket,
-                  :connection,
-                  :messages_total
+                  :connection
 
       @instance_count = 0
       @instance_mutex = Mutex.new
@@ -53,7 +52,7 @@ module Contrast
         zombie_check
         service_starter_thread.join(5)
         is_service_started = Contrast::Utils::OS.running?
-        logger.error(nil, 'The bundled service could not be started. The agent will not function properly.') unless is_service_started
+        logger.error('The bundled service could not be started. The agent will not function properly.') unless is_service_started
         is_service_started
       end
 
@@ -72,21 +71,14 @@ module Contrast
       # check if there's a zombie service that exists, and wait on it if so.
       # currently, this only happens when trying to initialize speedracer
       def zombie_check
-        return if windows?
-
         zombie_pid_list = Contrast::Utils::OS.zombie_pids
         zombie_pid_list.each do |pid|
           Process.wait(pid.to_i)
         end
       end
 
-      def windows?
-        @_windows = Contrast::Utils::OS.windows? if @_windows.nil?
-        @_windows
-      end
-
       def determine_startup_options
-        return { out: :out, err: :err } if Contrast::Agent::FeatureState.instance.service_control[:logger_path] == 'STDOUT'
+        return { out: :out, err: :err } if CONTRAST_SERVICE.logger_path == 'STDOUT'
 
         { out: File::NULL, err: File::NULL }
       end
@@ -136,11 +128,15 @@ module Contrast
         when Contrast::Api::Dtm::ObservedRoute
           message.observed_route = event
         else
-          logger.error("Unknown event type #{ event.cs__class.name } received. Unsure how to send.")
+          logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
           return
         end
-        # TODO: RUBY-794 make ID structured for parsing
-        logger.debug("Wrapping the event #{ event.__id__ } in message #{ message.__id__ } (#{ message.pid }-#{ message.message_count }.")
+        logger.debug('Wrapping event in message',
+                     msg_id: message.__id__,
+                     p_id: message.pid,
+                     msg_count: message.message_count,
+                     event_id: event.__id__,
+                     event_type: event.cs__class.name)
         message
       end
 
@@ -159,20 +155,28 @@ module Contrast
       end
 
       def send_message msg
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        logger.debug "[m__id__:#{ msg.__id__ }]\tSending message #{ msg.pid }-#{ msg.message_count }."
+        return unless msg
+
+        logger.debug('Sending message.',
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count)
         to_service = Contrast::Api::Dtm::Message.encode(msg)
         from_service = send_marshaled(to_service)
         response = Contrast::Api::Settings::AgentSettings.decode(from_service)
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        log_message = "[m__id__:#{ msg.__id__ }]\tReceived response: " \
-                      "#{ response ? response.__id__ : '[No Response]' } for " \
-                      "message #{ msg.pid }-#{ msg.message_count }."
-        logger.debug(log_message)
+        logger.debug('Received response.',
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count,
+                     response_id: response&.__id__)
         response
       rescue StandardError => e
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        logger.error(e, "[m__id__:#{ msg.__id__ }]\tSending failed for message #{ msg.pid }-#{ msg.message_count }.")
+        logger.error('Sending failed for message.',
+                     e,
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count,
+                     response_id: response&.__id__)
         raise e # reraise to let SocketClient manage the connection
       end
 

data/lib/contrast/api/tcp_socket.rb

@@ -11,8 +11,6 @@ module Contrast
     class TcpSocket
       include Contrast::Api::Socket
 
-      LOCAL_HOSTS = %w[localhost 127.0.0.1 0.0.0.0 ::1].cs__freeze
-
       attr_reader :host, :port
 
       # Create the socket

data/lib/contrast/components/agent.rb

@@ -2,19 +2,19 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'rubygems/version'
+cs__scoped_require 'contrast/agent/rule_set'
 
 module Contrast
   module Components
     module Agent
       # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
+      # for access of the values contained in its parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :analysis, :config, :settings
 
         def enabled?
           !!@enabled
@@ -32,12 +32,12 @@ module Contrast
           @enabled = false
         end
 
-        def unavailable?
-          !enabled?
+        def ruleset
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_ruleset&.values)
         end
 
-        def ready?
-          state.agent_ready?
+        def reset_ruleset
+          @_ruleset = nil
         end
 
         def patch_interpolation?
@@ -49,15 +49,26 @@ module Contrast
         end
 
         def patch_yield?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield)
+          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield
         end
 
         def interpolation_enabled?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate)
+          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled
+        end
+
+        def omit_body?
+          @_omit_body = true?(CONFIG.root.agent.omit_body) if @_omit_body.nil?
+          @_omit_body
         end
 
-        def report_custom_code_sysfile_access?
-          Contrast::Agent::FeatureState.instance.report_custom_code_sysfile_access?
+        def exception_control
+          @_exception_control ||= {
+              enable: true?(CONFIG.root.agent.ruby.exceptions.capture),
+              status: CONFIG.root.agent.ruby.exceptions.override_status || 403,
+              message: CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+          }
         end
 
         def skip_instrumentation? loaded_module_name
@@ -66,19 +77,6 @@ module Contrast
           loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
         end
 
-        # All this method chain does anymore is load the Thread patch that
-        # propagates request contexts.  That can go away RUBY-700.
-        SHARED_LIBRARIES = %w[contrast/extensions/ruby_core/thread].cs__freeze
-        def run_instrumentation
-          Contrast::Agent::FeatureState.instance.tap do |settings|
-            SHARED_LIBRARIES.each { |lib| settings.instrument lib }
-          end
-          Contrast::Agent::Patching::Policy::Patcher.patch # This acts as a catch up for everything we didn't see get loaded
-          enable_tracepoint # This handles all class loads & required instrumentation going forward
-        end
-
-        # TODO: RUBY-564: This responsibility should be extracted out of this agent component and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
         def insert_middleware app
           app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
         end
@@ -96,6 +94,18 @@ module Contrast
           @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
           @_interpolation_patch_possible
         end
+
+        def retrieve_ruleset
+          return {} unless enabled?
+
+          if ASSESS.enabled? && PROTECT.enabled?
+            ASSESS.rules.merge(PROTECT.rules)
+          elsif ASSESS.enabled?
+            ASSESS.rules
+          else
+            PROTECT.rules
+          end
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new