contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Sinatra
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Sinatra framework.
+        module Support
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Sinatra::Base',
+                          'contrast/framework/sinatra/patch/base',
+                          method_to_instrument: nil,
+                          instrumenting_module: 'Contrast::Framework::Sinatra::Patch::Base')
+                    ])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/support.rb

@@ -0,0 +1,109 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/sinatra/application_helper'
+cs__scoped_require 'contrast/framework/sinatra/patch/support'
+
+module Contrast
+  module Framework
+    module Sinatra
+      # Used when Sinatra is present to define framework specific behavior
+      class Support < BaseSupport
+        extend Contrast::Framework::Sinatra::ApplicationHelper
+        extend Contrast::Framework::Sinatra::Patch::Support
+        class << self
+          def detection_class
+            'Sinatra'
+          end
+
+          def version
+            ::Sinatra::VERSION
+          end
+
+          def application_name
+            return unless app_class
+
+            app_class.cs__class.cs__name
+          end
+
+          def application_root
+            return unless app_class
+
+            app_class.root
+          end
+
+          def server_type
+            'sinatra'
+          end
+
+          def scan_views
+            return unless app_class
+
+            scan_view_directories(scannable_view_dirs)
+          end
+
+          # Iterate over every class that extends Sinatra::Base, pull out its routes
+          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+          # Contrast::Api::Dtm::RouteCoverage
+          def collect_routes
+            routes = []
+            controllers = sinatra_controllers
+            controllers.each do |clazz|
+              class_routes = sinatra_class_routes(clazz)
+              next unless class_routes
+
+              class_routes.each_pair do |method, list|
+                # item: [ Mustermann::Sinatra, [], Proc]
+                list.each do |item|
+                  routes << route_to_coverage(clazz, method, item[0])
+                end
+              end
+            end
+            routes
+          end
+
+          # TODO: RUBY-763
+          def current_route _request
+            nil
+          end
+
+          def retrieve_request env
+            ::Sinatra::Request.new(env)
+          end
+
+          private
+
+          # Iterate over every class that extends Sinatra::Base, pull out its routes
+          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+          # Contrast::Api::Dtm::RouteCoverage
+          def sinatra_controllers
+            return [] unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            Contrast::Utils::ClassUtil.descendants(::Sinatra::Base)
+          end
+
+          def sinatra_class_routes controller
+            controller.instance_variable_get(:@routes) if controller.instance_variable_defined?(:@routes)
+          rescue StandardError
+            logger.trace('Sinatra controller found with no route instances', module: controller)
+            nil
+          end
+
+          # TODO: RUBY-763
+          # given clazz, method, and Mustermann::Sinatra, build a
+          # Contrast::Api::Dtm::RouteCoverage
+          def route_to_coverage clazz, method, pattern
+            safe_pattern = source_or_string(pattern)
+
+            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
+            route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            route_coverage
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -6,6 +6,7 @@ module Contrast
     # Used to define common locations and extensions for specific technologies
     class ViewTechnologiesDescriptor
       attr_reader :path, :extension, :technology_names
+
       def initialize path, extension, technology_names
         @path = path
         @extension = extension

data/lib/contrast/logger/application.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Logger
+    # # Our decorator for the Ougai logger allowing for the logging of the
+    # application environment, used to provide context during troubleshooting.
+    module Application
+      include Contrast::Components::Interface
+      access_component :config
+
+      ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
+      # Utility method to log some current ruby and rails information from environment
+      def application_environment
+        return unless info?
+
+        info('Process environment information',
+             p_id: Process.pid,
+             pp_id: Process.ppid,
+             agent_version: Contrast::Agent::VERSION)
+        ENV.each do |env_key, env_value|
+          env_key = env_key.to_s
+          next unless ENV_KEYS.include?(env_key) ||
+              (env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) &&
+                  !env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER + 'API'))
+
+          info('Environment settings', key: env_key, value: env_value)
+        end
+      end
+
+      def application_configuration
+        return unless info?
+
+        loggable = CONFIG.raw.send(:load_config)
+        loggable.delete('api')
+        info('Current configuration', configruation: JSON.pretty_generate(loggable))
+      end
+
+      def application_libraries
+        if debug?
+          log_all_libraries
+        elsif info?
+          log_specific_libraries
+        end
+      end
+
+      FRAMEWORKS = %w[rails sinatra grape].cs__freeze
+      WEB_SERVERS = %w[agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn webrick yarn].cs__freeze
+      LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
+      def log_specific_libraries
+        FRAMEWORKS.each(&cs__method(:log_gem_data))
+        WEB_SERVERS.each(&cs__method(:log_gem_data))
+        LIBRARIES.each(&cs__method(:log_gem_data))
+      end
+
+      private
+
+      def log_all_libraries
+        return unless debug?
+
+        Gem.loaded_specs.each_pair do |_name, gem_spec|
+          debug('Gem loaded',
+                gem_name: gem_spec.name,
+                gem_version: gem_spec.version.to_s)
+        end
+      end
+
+      def log_gem_data gem_name
+        gem_spec = Gem.loaded_specs[gem_name]
+        return unless gem_spec
+
+        info('Gem loaded',
+             gem_name: gem_spec.name,
+             gem_version: gem_spec.version.to_s)
+      end
+    end
+  end
+end

data/lib/contrast/logger/log.rb

@@ -0,0 +1,143 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'logger'
+cs__scoped_require 'ougai'
+cs__scoped_require 'singleton'
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/logger/application'
+cs__scoped_require 'contrast/logger/time'
+
+module Contrast
+  module Logger
+    # This class functions to serve as a wrapper around our logging, as we need
+    # to be able to dynamically update level based on updates to TeamServer.
+    class Log
+      include Singleton
+      include Contrast::Components::Interface
+      access_component :config
+
+      DEFAULT_NAME     = 'contrast.log'
+      DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
+      VALID_LEVELS     = ::Ougai::Logging::Severity::SEV_LABEL
+      STDOUT_STR       = 'STDOUT'
+      STDERR_STR       = 'STDERR'
+
+      attr_reader :previous_path,
+                  :previous_level
+
+      def initialize
+        update
+      end
+
+      # Given new settings from TeamServer, update our logging to use the new
+      # file and level, assuming they weren't set by local configuration.
+      #
+      # @param log_file [String] the file to which to log
+      # @param log_level [String] the level at which to log
+      def update log_file = nil, log_level = nil
+        config = CONFIG.root.agent.logger
+
+        config_path  = config.path&.length.to_i.positive? ? config.path : nil
+        config_level = config.level&.length&.positive? ? config.level : nil
+
+        # config > settings > default
+        path        = valid_path(config_path   || log_file)
+        level_const = valid_level(config_level || log_level)
+
+        # don't needlessly recreate logger
+        return if @_logger && (path == previous_path) && (level_const == previous_level)
+
+        @previous_path  = path
+        @previous_level = level_const
+
+        @_logger = build(path: path, level_const: level_const)
+        log_update
+      rescue StandardError => e
+        if logger
+          logger.error('Unable to process update to LoggerManager.', e)
+        else
+          puts 'Unable to process update to LoggerManager.'
+          puts e.backtrace.join("\n")
+        end
+      end
+
+      def logger
+        @_logger
+      end
+
+      # StringIO is a valid path because it logs directly to a string buffer
+      def write_permission? path
+        return false if path.nil?
+        return true if path.is_a?(StringIO)
+        return File.writable?(path) if File.exist?(path)
+
+        dir_name = File.dirname(File.absolute_path(path))
+        File.writable?(dir_name)
+      end
+
+      private
+
+      def build path: STDOUT_STR, level_const: DEFAULT_LEVEL
+        logger = case path
+                 when STDOUT_STR, STDERR_STR
+                   ::Ougai::Logger.new(Object.cs__const_get(path))
+                 else
+                   ::Ougai::Logger.new(path)
+                 end
+        add_contrast_loggers(logger)
+        logger.progname = 'Contrast Agent'
+        logger.level = level_const
+        logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
+        logger
+      end
+
+      def add_contrast_loggers logger
+        logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Time)
+      end
+
+      def valid_path path
+        path = path.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : path
+        return path if path == STDOUT_STR
+        return path if path == STDERR_STR
+
+        path = DEFAULT_NAME if path.empty?
+        if write_permission?(path)
+          path
+        elsif write_permission?(DEFAULT_NAME)
+          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
+          DEFAULT_NAME
+        else
+          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead."
+          STDOUT_STR
+        end
+      end
+
+      def valid_level level
+        level ||= DEFAULT_LEVEL
+        level = level.upcase
+        if VALID_LEVELS.include?(level)
+          Object.cs__const_get("::Ougai::Logging::Severity::#{ level }")
+        else
+          DEFAULT_LEVEL
+        end
+      rescue StandardError
+        DEFAULT_LEVEL
+      end
+
+      # Log that the Agent log has changed and include some default information
+      # at the start of the log.
+      def log_update
+        logger.debug('Initialized new contrast agent logger')
+        logger.debug_with_time('middleware: log environment') do
+          logger.application_environment
+          logger.application_configuration
+          logger.application_libraries
+        end
+      end
+    end
+  end
+end

data/lib/contrast/logger/time.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for timing and with_level
+    # methods.
+    module Time
+      # Log the message at the given level.
+      #
+      # @param level [String] the name of the method to use. Should be one of
+      #   trace, debug, info, warn, error
+      # @param message [String] the message to log
+      def with_level level, message
+        send(level.to_sym, message)
+      end
+
+      # Log, at the debug level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def debug_with_time *msgs, &block
+        log_with_time(:debug, *msgs, &block)
+      end
+
+      # Log, at the trace level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def trace_with_time *msgs, &block
+        log_with_time(:trace, *msgs, &block)
+      end
+
+      private
+
+      def log_with_time level, *msgs
+        a = Contrast::Utils::Timer.now_ms
+        ret = yield if block_given?
+        z = Contrast::Utils::Timer.now_ms
+        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
+        send(level, *msgs)
+        ret
+      end
+    end
+  end
+end

data/lib/contrast/tasks/config.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'yaml'
+
+module Contrast
+  # A Rake task to generate a contrast_security.yaml file with some basic settings
+  module Config
+    extend Rake::DSL
+    include Contrast::Components::Interface
+    DEFAULT_CONFIG = {
+        'api' => {
+            'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',
+            'api_key' => 'Enter your Contrast api key',
+            'service_key' => 'Enter your Contrast service key',
+            'user_name' => 'Enter your Contrast user name'
+        },
+        'agent' => {
+            'service' => {
+                'logger' => {
+                    'path' => 'contrast_service.log',
+                    'level' => 'ERROR' # DEBUG | INFO | WARN | ERROR
+                },
+                'socket' => '/tmp/contrast_service.sock'
+            },
+            'logger' => {
+                'level' => 'ERROR',
+                'path' => 'contrast_agent.log'
+            }
+        }
+    }.cs__freeze
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Create a contrast_security.yaml in the applications root directory'
+        task :create do
+          execution_directory = Dir.pwd
+          target_path = File.join(execution_directory, 'contrast_security.yaml')
+          if File.exist?(target_path)
+            puts 'WARNING: contrast_security.yaml already exists'
+          else
+            File.open(target_path, 'w') do |f|
+              f.write(YAML.dump(DEFAULT_CONFIG))
+            end
+
+            puts "Created contrast_security.yaml at #{ target_path }"
+            puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
+            puts 'Visit our documentation site for more details: https://docs.contrastsecurity.com/installation-rubyconfig.html'
+          end
+        end
+      end
+    end
+  end
+end