contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/tasks/service.rb

@@ -33,14 +33,8 @@ module Contrast
 
     # Stop the service if it is running
     def self.stop_service
-      if Contrast::Utils::OS.windows?
-        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
-        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
-        `Taskkill /PID #{ pid } /F` if pid
-      else
-        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
-        `kill #{ pid }` if pid
-      end
+      pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
+      `kill #{ pid }` if pid
     end
 
     namespace :contrast do
@@ -49,8 +43,6 @@ module Contrast
         task :start do
           if Contrast::Utils::OS.running?
             puts 'Contrast Service already running. No need to start'
-          elsif !CONTRAST_SERVICE.enabled?
-            puts 'Contrast Service disabled by configuration. Not starting.'
           else
             start_service
           end
@@ -64,10 +56,8 @@ module Contrast
         task :status do
           if Contrast::Utils::OS.running?
             puts 'online'
-          elsif CONTRAST_SERVICE.enabled?
-            puts 'offline'
           else
-            puts 'disabled'
+            puts 'offline'
           end
         end
       end

data/lib/contrast/utils/assess/sampling_util.rb

@@ -19,7 +19,8 @@ module Contrast
         end
 
         def update
-          @enabled            = self.class.sampling_control[:enabled]
+          self.class.reset_sampling_control
+          @enabled            = self.class.sampling_enabled?
           @baseline           = self.class.sampling_control[:baseline]
           @request_frequency  = self.class.sampling_control[:request_frequency]
           @response_frequency = self.class.sampling_control[:response_frequency]
@@ -28,10 +29,6 @@ module Contrast
           true
         end
 
-        def reset
-          @requests.clear
-        end
-
         def sample? request
           history = request_history(request)
           history.hit
@@ -64,20 +61,18 @@ module Contrast
 
         # RequestHistory tracks one requests history per time window
         class RequestHistory
-          attr_accessor :window_start, :total_hit, :window_hit
+          attr_reader :window_start, :window_hit
 
           def initialize
             @window_start = Contrast::Utils::Timer.now_ms
-            @total_hit = 0
             @window_hit = 0
           end
 
           def elapsed
-            Contrast::Utils::Timer.now_ms - @window_start
+            Contrast::Utils::Timer.now_ms - window_start
           end
 
           def hit cnt = 1
-            @total_hit += cnt
             @window_hit += cnt
           end
 

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,11 +1,17 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
+        include Contrast::Components::Interface
+
+        access_component :logging
+
         def self.tracked? obj
           return false if obj.nil?
 
@@ -28,7 +34,7 @@ module Contrast
           # This is used to ask if a ton of objects are tracked. They may not
           # all be iterable. Bad things could happen in some cases, like when
           # checking a closed statement for SQL injection trigger events
-          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
+          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
           false
         end
       end

data/lib/contrast/utils/boolean_util.rb

@@ -10,17 +10,17 @@ module Contrast
     class BooleanUtil
       class << self
         def false? config
-          return false unless config
           return false if config == true
           return true if config == false
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
         end
 
         def true? config
-          return false unless config
           return false if config == false
           return true if config == true
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
         end

data/lib/contrast/utils/cache.rb

@@ -10,17 +10,6 @@ module Contrast
         @data = {}
       end
 
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
       def [] key
         found = true
         value = @data.delete(key) { found = false }

data/lib/contrast/utils/class_util.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
@@ -55,8 +56,11 @@ module Contrast
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          if object.cs__is_a?(String)
-            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+          # Only treat object like a string if it actually is a string
+          # some subclasses of String override string methods we depend on
+          if object.cs__class == String
+            cached = to_cached_string(object)
+            return cached if cached
 
             object.dup
           elsif object.cs__is_a?(Symbol)
@@ -65,6 +69,8 @@ module Contrast
             object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -107,6 +113,21 @@ module Contrast
 
           mod
         end
+
+        # If the String matches a common String in our ObjectShare, return that
+        # rather that for use as the representation of the String rather than
+        # forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast
+        #   representation.
+        # @return [String,nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
+
+          nil
+        end
       end
     end
   end

data/lib/contrast/utils/gemfile_reader.rb

@@ -15,7 +15,7 @@ module Contrast
       include Singleton
       include Contrast::Components::Interface
 
-      access_component :logging
+      access_component :config, :logging
 
       CONTRAST_AGENT = 'contrast-agent'
 
@@ -55,9 +55,10 @@ module Contrast
           paths = get_by_digest(digest)
           path = spec.full_gem_path
           $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
+            next unless line.cs__is_a?(String)
+            next unless line.start_with?(path)
 
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
+            logger.trace('Recording loaded gem for inventory analysis', line: line)
             updated!
             paths << adjust_lib(line)
           end
@@ -91,11 +92,11 @@ module Contrast
           usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
           usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
           activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
+          # TODO: RUBY-882 once TS switches to take filenames, remove the count setter and
           #   send the class names in usage.class_names
           usage.count = files.size
         end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
+        # TODO: RUBY-882 once TS switches to take filenames, clear this and remove the
         #   @updated variable
 
         # @spec_to_files.clear
@@ -137,6 +138,7 @@ module Contrast
         lib.external_ms = date_to_ms(spec.date)
         lib.internal_ms = lib.external_ms
         lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
+        # Library tags are appended in the ApplicationUpdate delegator
         update_class_counts(lib, digest, spec)
         lib
       end

data/lib/contrast/utils/hash_digest.rb

@@ -69,6 +69,8 @@ module Contrast
           hash.finish
         end
 
+        private
+
         def generate_crypto_hash finding, algorithm
           hash = new
           hash.update(finding.rule_id)
@@ -85,13 +87,6 @@ module Contrast
           hash.finish
         end
 
-        def generate_response_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
-
         def generate_trigger_hash finding
           hash = new
           hash.update(finding.rule_id)
@@ -136,10 +131,6 @@ module Contrast
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
-      def reset
-        @crc32 = 0
-      end
-
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil
       include Contrast::Components::Interface
-      access_component :logging, :heap_dump
+      access_component :heap_dump, :logging
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'
@@ -25,12 +25,13 @@ module Contrast
 
           delay = heap_dump_control[:delay]
           Contrast::Agent::Thread.new do
-            logger.info("HEAP DUMP THREAD INITIALIZED.  WAITING #{ delay } SECONDS TO BEGIN.")
+            logger.info("HEAP DUMP THREAD INITIALIZED. WAITING #{ delay } SECONDS TO BEGIN.")
             sleep(delay)
             capture_heap_dump
           end
         rescue StandardError => e
           logger.info(LOG_ERROR_DUMPS, e)
+          nil
         end
 
         def log_enabled_warning
@@ -79,21 +80,21 @@ module Contrast
           window = heap_dump_control[:window]
           count  = heap_dump_control[:count]
           clean  = heap_dump_control[:clean]
-          logger.info(nil, 'HEAP DUMP MAIN LOOP')
+          logger.info('HEAP DUMP MAIN LOOP')
           ObjectSpace.trace_object_allocations_start
           count.times do |i|
-            logger.info(nil, "STARTING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+            logger.info('STARTING HEAP DUMP PASS', current_pass: i + 1, max: count)
             output = "#{ Time.now.to_f }-heap.dump"
             output = File.join(dir, output)
             begin
-              logger.info(nil, "OPENING FILE #{ dir }/#{ output } FOR HEAP DUMP")
+              logger.info('OPENING HEADUMP FILE', dir: dir, file: output)
               file = File.new(output, FILE_WRITE_FLAGS)
               if clean
-                logger.info(nil, 'PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
+                logger.info('PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
                 GC.start
               end
               ObjectSpace.dump_all(output: file)
-              logger.info(nil, "FINISHING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+              logger.info('FINISHING HEAP DUMP PASS', current_pass: i + 1, max: count)
             ensure
               file.close
             end
@@ -101,10 +102,10 @@ module Contrast
           end
         ensure
           ObjectSpace.trace_object_allocations_stop
-          logger.info(nil, '*****************************************************')
-          logger.info(nil, '********        HEAP DUMP HAS CONCLUDED      ********')
-          logger.info(nil, '***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
-          logger.info(nil, '*****************************************************')
+          logger.info('*****************************************************')
+          logger.info('********        HEAP DUMP HAS CONCLUDED      ********')
+          logger.info('***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
+          logger.info('*****************************************************')
           exit # We weren't kidding!
         end
       end

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      access_component :analysis, :app_context, :logging
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -45,16 +45,16 @@ module Contrast
         activity.findings << finding
 
         # If assess is enabled, we can just send the activity
-        if ASSESS.enabled?
+        if APP_CONTEXT.ready?
           build_tags(activity)
-          CONTRAST_SERVICE.queue_message activity
+          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
         # Otherwise, if the Agent isn't ready, we have to queue the messages
         # until we know the starting state.
         else
           Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
         end
       rescue StandardError => e
-        logger.error(e, "Unable to build a finding for #{ rule_id }")
+        logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private

data/lib/contrast/utils/inventory_util.rb

@@ -29,7 +29,7 @@ module Contrast
       def self.inventory_class class_path
         Contrast::Utils::GemfileReader.instance.map_class(class_path)
       rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
+        logger.error('Unable to inventory module', e, path: class_path)
       end
 
       def self.active_record_config
@@ -56,7 +56,7 @@ module Contrast
           activity_or_update.technologies[a.vendor] = true
         end
       rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
+        logger.error('Unable to append db config', e)
         nil
       end
 

data/lib/contrast/utils/io_util.rb

@@ -11,16 +11,6 @@ module Contrast
 
       access_component :logging
 
-      # StringIO is a valid path because it logs directly to a string buffer
-      def self.write_permission? path
-        return false if path.nil?
-        return true if path.is_a?(StringIO)
-        return File.writable?(path) if File.exist?(path)
-
-        dir_name = File.dirname(File.absolute_path(path))
-        File.writable?(dir_name)
-      end
-
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
       # all others.
@@ -30,7 +20,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug(e, "Encountered an issue inspecting instance of #{ potential_io } - continuing without rewind")
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -7,17 +7,19 @@ module Contrast
     # the application are running
     module JobServersRunning
       include Contrast::Components::Interface
-      access_component :logging
+      access_component :app_context, :logging
 
       class << self
         def job_servers_running?
           sidekiq_running? || rake_running?
         end
 
+        private
+
         def sidekiq_running?
           return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
 
-          logger.debug(nil, 'Detected the spawn of a Sidekiq process')
+          logger.trace('Detected the spawn of a Sidekiq process')
           true
         end
 
@@ -26,11 +28,11 @@ module Contrast
               Rake.cs__respond_to?(:application) &&
               Rake.application.cs__respond_to?(:top_level_tasks)
 
-          disabled_rake_tasks = Contrast::Agent::FeatureState.instance.disabled_agent_rake_tasks
+          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
           has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
           return false unless has_disabled_task
 
-          logger.debug(nil, 'Detected startup within Rake task')
+          logger.trace('Detected startup within Rake task')
           true
         end
       end