contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/agent/assess/properties.rb

@@ -5,7 +5,8 @@ cs__scoped_require 'set'
 cs__scoped_require 'base64'
 cs__scoped_require 'contrast/utils/prevent_serialization'
 cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/agent/assess/contrast_event'
+cs__scoped_require 'contrast/agent/assess/events/event_factory'
+cs__scoped_require 'contrast/agent/assess/events/source_event'
 
 module Contrast
   module Agent
@@ -285,8 +286,8 @@ module Contrast
           self
         end
 
-        def build_event policy_node, tagged, object, ret, args, invoked = 0, source_type = nil, source_name = nil
-          event = Contrast::Agent::Assess::ContrastEvent.new(policy_node, tagged, object, ret, args, invoked, source_type, source_name)
+        def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
+          event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
           add_event(event)
           report_sources(tagged, event)
         end
@@ -295,6 +296,7 @@ module Contrast
 
         def report_sources tagged, event
           return unless tagged && !tagged.to_s.empty?
+          return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
           return unless event&.source_type
 
           current_request = Contrast::Agent::REQUEST_TRACKER.current

data/lib/contrast/agent/assess/rule/base.rb

@@ -13,7 +13,7 @@ module Contrast
         # The base class for each of our Assess Rules
         class Base
           include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :settings
+          access_component :agent, :analysis, :logging, :settings
 
           def initialize
             SETTINGS.assess_rules[name] = self
@@ -46,25 +46,6 @@ module Contrast
               ex.assess_rule?(name)
             end
           end
-
-          def send_report finding
-            finding.rule_id = name
-            finding.hash_code = generate_hash(finding)
-            finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
-            finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
-            finding.tags = ASSESS.tags.to_s
-
-            current_context = Contrast::Agent::REQUEST_TRACKER.current
-            current_context.activity.findings << finding
-          end
-
-          def generate_hash finding
-            Contrast::Utils::HashDigest.generate_trigger_hash(finding)
-          end
-
-          def trace_tags
-            @_trace_tags ||= ASSESS.tags.to_s
-          end
         end
       end
     end

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 
 module Contrast
   module Agent
@@ -19,7 +19,7 @@ module Contrast
           # 4) redacted_marker : the value to plug in for the obfuscated value
           module HardcodedValueRule
             include Contrast::Components::Interface
-            access_component :contrast_service, :logging, :analysis
+            access_component :analysis, :app_context, :logging, :settings
 
             def disabled?
               !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
@@ -88,12 +88,14 @@ module Contrast
             # The constant name
             SOURCE_KEY = 'source'
 
+            private
+
             def report_finding clazz, constant_string
               class_name = clazz.cs__name
 
               finding = Contrast::Api::Dtm::Finding.new
               finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(rule_id)
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+              finding.session_id = SETTINGS.session_id
 
               finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
 
@@ -106,12 +108,27 @@ module Contrast
               finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
 
               activity = Contrast::Api::Dtm::Activity.new
-              activity.finding_tags = Contrast::Utils::StringUtils.protobuf_safe_string(ASSESS.tags)
               activity.findings << finding
 
-              CONTRAST_SERVICE.queue_message activity
+              # If assess is enabled, we can just send the activity
+              if APP_CONTEXT.ready?
+                build_tags(activity)
+                Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
+                # Otherwise, if the Agent isn't ready, we have to queue the messages
+                # until we know the starting state.
+              else
+                Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
+              end
             rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for Hardcoded Rule')
+              logger.error('Unable to build a finding for Hardcoded Rule', e)
+            end
+
+            # This seems silly to pull out, but we can ONLY call this in the case
+            # where we have a configuration. Doing otherwise results in a bad error
+            # case where we try to do other things, like logging, which behave
+            # strangely without a config
+            def build_tags activity
+              activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
             end
           end
         end

data/lib/contrast/agent/assess/rule/redos.rb

@@ -17,7 +17,7 @@ module Contrast
               NAME
             end
 
-            def regexp_complexity_check context, trigger_node, source, object, ret, invoked, *args
+            def regexp_complexity_check context, trigger_node, source, object, ret, *args
               # we can arrive here either from:
               #   regexp =~ string
               #   string =~ regexp
@@ -31,9 +31,9 @@ module Contrast
               return unless regexp_vulnerable?(regexp)
 
               # (2) regexp must evaluate against user input
-              if trigger_node.violated?(string) # rubocop:disable Style/GuardClause
-                Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, invoked + 1, args)
-              end
+              return unless trigger_node.violated?(string)
+
+              Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, args)
             end
 
             protected
@@ -54,7 +54,6 @@ module Contrast
               # will have the same functional characteristics as the original.
               # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
               # Regexp#source will give you the original source.
-              # TODO RUBY-683, would we ever get a hit on one but not the other?
 
               # Use #match? because it doesn't fill out global variables
               # in the way match or =~ do.

data/lib/contrast/agent/assess/tag.rb

@@ -33,6 +33,10 @@ module Contrast
           start_idx...end_idx
         end
 
+        def extends_beyond_string_size? string_length
+          @end_idx > string_length
+        end
+
         # Return if a given tag overlaps this one
         def overlaps? other
           return true if @start_idx <  other.start_idx && @end_idx >= other.start_idx  # we start below other & end in it
@@ -100,27 +104,33 @@ module Contrast
         # The tag is ______ the range
         # rrrrrrr == self.range, the range of the tag
         def compare_range start, stop
-          # r starts and stops below
-          # rrrrrrrrrrrrr
-          #               start       stop
-          return BELOW     if @start_idx <  start && @end_idx <= start
-          # r starts below and finishes within
-          # rrrrrrrrrrrrr
-          #    start       stop
-          return LOW_SPAN  if @start_idx <  start && @end_idx > start && @end_idx <= stop
+          # the range starts below the given values
+          if @start_idx < start
+            # r starts and stops below
+            # rrrrrrrrrrrrr
+            #               start       stop
+            return BELOW if @end_idx <= start
+            # r starts below and finishes within
+            # rrrrrrrrrrrrr
+            #    start       stop
+            return LOW_SPAN if @end_idx > start && @end_idx <= stop
+            # r starts below and finishes above stop
+            #  rrrrrrrrrrrrrrrrrrrrrrrr
+            #     start       stop
+            return WITHOUT if @end_idx > stop
+          end
+
+          # the range starts at or above the given values
           # r is between start and stop
           #        rrrrrrrrrrrrrrr
           # start                   stop
-          return WITHIN    if @start_idx >= start && @start_idx < stop && @end_idx <= stop
-          # r starts below and finishes above stop
-          #  rrrrrrrrrrrrrrrrrrrrrrrr
-          #     start       stop
-          return WITHOUT   if @start_idx <  start && @end_idx > stop
+          return WITHIN if @start_idx < stop && @end_idx <= stop
           # r starts within and finishes above stop
           #           rrrrrrrrrrrrr
           #   start       stop
-          return HIGH_SPAN if @start_idx >= start && @start_idx < stop && @end_idx > stop
+          return HIGH_SPAN if @start_idx < stop && @end_idx > stop
 
+          # the range is above the given values
           # starts and stops above
           #                   rrrrrrrrrrrrr
           #  start       stop

data/lib/contrast/agent/at_exit_hook.rb

@@ -8,26 +8,29 @@ module Contrast
     # This module adds an at_exit hook for us to send messages that may be lost at process exit
     module AtExitHook
       include Contrast::Components::Interface
-      access_component :logging, :contrast_service
-
-      TERMINATION_NOTICE = 'at_exit invoked, host application terminating'
-
+      access_component :logging
       def self.exit_hook
         @_exit_hook ||= begin
                           at_exit do
-                            logger.debug(TERMINATION_NOTICE)
-
-                            context = Contrast::Agent::REQUEST_TRACKER.current
-                            CONTRAST_SERVICE.send_message(context.activity) if context
-
-                            logger.debug(" - current PID  #{ @pid  }")
-                            logger.debug(" - current PPID #{ @ppid }")
-                            logger.debug(" - process PID  #{ Process.pid  }")
-                            logger.debug(" - process PPID #{ Process.ppid }")
+                            on_exit
                           end
                           true
                         end
       end
+
+      # Actions to take when a process exits. Typically called from our
+      # exit_hook, but exposed here for other process terminations, like those
+      # in Kernel#exec
+      def self.on_exit
+        logger.debug('at_exit invoked, host application terminating',
+                     p_id: @pid,
+                     pp_id: @ppid,
+                     process_pid: Process.pid,
+                     process_pp_id: Process.ppid)
+
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        Contrast::Utils::ServiceSenderUtil.send_event_immediately(context.activity) if context
+      end
     end
   end
 end

data/lib/contrast/agent/class_reopener.rb

@@ -2,25 +2,30 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'ripper'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/logger/log'
 
 # This method is left purposefully at the top level namespace. Moving it
 # elsewhere will break functionality as it executes evaluations against the
 # namespace from which it is called -- ie putting it in Contrast would make all
 # changes it intends for Foo happen to Contrast::Foo instead
 #
-# @param class_name [String] the name of the class in which the eval will
+# @param _class_name [String] the name of the class in which the eval will
 #   redefine functionality
 # @param content [String] the String content that will function as the code in
 #   the given class
-def unbound_eval class_name, content
+def unbound_eval _class_name, content
   # Yuck, this is a top-level method that has to break encapsulation
   # in order to access scoping!
   Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope!
   eval(content) # rubocop:disable Security/Eval
 rescue Exception # rubocop:disable Lint/RescueException
-  Contrast::Agent::SettingsState.log_error("Unable to perform unbound eval of new content for #{ class_name }.")
+  # We can't use components here, so we have to access the log directly. I hate
+  # it, but we'll have to deal with it until we remove 2.5 support.
+  Contrast::Logger::Log.instance.logger.error('Unable to perform unbound eval of new content', module: class_name)
+  # And we need to return nil here, not the value from the logger.
+  nil
 ensure
   Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope!
 end
@@ -115,9 +120,7 @@ module Contrast
       def source_code location, method_name
         file_name = location[0]
         line_number = location[1]
-        return unless file_name && line_number
-        return unless File.exist?(file_name) && File.readable?(file_name)
-        return if File.empty?(file_name)
+        return unless file_contents_available?(file_name, line_number)
 
         files[file_name] = File.readlines(file_name) unless files.key?(file_name)
         lines = files[file_name]
@@ -130,7 +133,11 @@ module Contrast
           break if complete?(code)
         end
         unless complete?(code) && compiles?(code)
-          logger.warn("Failed to capture #{ method_name } in #{ file_name } at #{ line_number } for rewriting.")
+          logger.warn(
+              'Failed to determine sourcecode for rewriting.',
+              file: file_name,
+              method: method_name,
+              line_number: line_number)
           return
         end
         code
@@ -138,6 +145,14 @@ module Contrast
 
       private
 
+      def file_contents_available? file_name, line_number
+        return false unless file_name && line_number
+        return false unless File.exist?(file_name) && File.readable?(file_name)
+        return false if File.empty?(file_name)
+
+        true
+      end
+
       def gather_modules
         return if class_module_path.nil?
 

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -37,14 +37,14 @@ module Contrast
 
           def add_node node, _node_type = :deadzones
             unless node
-              logger.error(nil, 'Node was nil when adding node to policy')
+              logger.error('Node was nil when adding node to policy')
               return
             end
 
             begin
               node.validate
             rescue ArgumentError => e
-              logger.error(e, e.message)
+              logger.error('Node failed validation', e)
               return
             end
 

data/lib/contrast/agent/disable_reaction.rb

@@ -10,13 +10,12 @@ module Contrast
     # set by the Organization's Administrator
     class DisableReaction
       include Contrast::Components::Interface
-      access_component :logging, :agent
+      access_component :agent, :logging
 
       def self.run _reaction, level
         logger.with_level(
-            nil,
-            'Contrast received instructions to disable itself - Disabling now',
-            level)
+            level,
+            'Contrast received instructions to disable itself - Disabling now')
         AGENT.disable!
       end
     end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -12,6 +12,10 @@ module Contrast
       include Contrast::Components::Interface
       access_component :logging
 
+      # Create a matcher around an exclusion sent from TeamServer.
+      #
+      # @param excl [Contrast::Api::Settings::Exclusion]
+      # @return [Contrast::Agent::ExclusionMatcher]
       def initialize excl
         @exclusion = excl
         @protect = @exclusion.protect
@@ -58,10 +62,10 @@ module Contrast
       # Contrast UI, these comparisons must be done at the end of the input.
       # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
       def handle_wildcard_code
-        return unless @exclusion.blacklist&.any?
+        return unless @exclusion.denylist&.any?
 
         @wildcard_exclusions = []
-        @exclusion.blacklist.each do |code|
+        @exclusion.denylist.each do |code|
           class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
           class_pattern = build_regexp(class_name, false, true)
           method_pattern = build_regexp(method_name)
@@ -76,7 +80,7 @@ module Contrast
         pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
         Regexp.compile(pattern)
       rescue RegexpError => e
-        logger.error(e, "Unable to generate a pattern for #{ pattern }. It will not be used for exclusion matching.")
+        logger.error('Unable to generate a pattern for exclusion matching.', e, pattern: pattern)
       end
 
       def protect?
@@ -87,14 +91,6 @@ module Contrast
         @assess
       end
 
-      def url?
-        @exclusion.type == :URL
-      end
-
-      def input?
-        @exclusion.type == :INPUT
-      end
-
       def code?
         @exclusion.type == :CODE
       end
@@ -131,43 +127,6 @@ module Contrast
             )
       end
 
-      def match_url? url
-        return false unless url?
-        return true if @wildcard_url
-
-        @urls.any? { |test| url.match?(test) }
-      end
-
-      def match_input? value, type
-        return false unless input?
-
-        exclusion_type = @exclusion.input_type
-        case type
-        when :PARAMETER_NAME, :PARAMETER_VALUE
-          return exclusion_type == :PARAMETER && value_match?(value)
-        when :COOKIE_NAME, :COOKIE_VALUE
-          return exclusion_type == :COOKIE && value_match?(value)
-        when :HEADER
-          return exclusion_type == :HEADER && value_match?(value, false)
-        when :BODY
-          return exclusion_type == :BODY
-        when :QUERYSTRING
-          return exclusion_type == :QUERYSTRING
-        end
-
-        false
-      end
-
-      def value_match? value, case_sensitive = true
-        return true if @wildcard_input
-
-        if case_sensitive
-          value == @exclusion.input_name
-        else
-          @exclusion.input_name.casecmp(value).zero?
-        end
-      end
-
       def match_code? stack_trace
         return false unless code?
         return false if @wildcard_exclusions&.empty?