contrast-agent 3.10.2 → 3.11.0

data/lib/contrast/agent/rule_set.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # This class is responsible for holding our ruleset and performing filtering operations on all
+    # rules when asked by the middleware.
+    class RuleSet < Set
+      include Contrast::Components::Interface
+      access_component :analysis, :logging
+
+      # The filtering that needs to happen before the application gets access to the request object.
+      # The main action here is snapshotting the request as provided to the application from the
+      # user before any application code has acted upon it. Additionally, this is where Protect will
+      # terminate requests on attack detection if set to block at perimeter
+      def prefilter
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        # TODO: RUBY-801 We shouldn't be responsible for knowing what modes are enabled
+        return unless context.analyze_request? || PROTECT.enabled?
+
+        logger.trace_with_time('Running prefilter...') do
+          map { |rule| rule.prefilter(context) }
+        end
+      rescue Contrast::SecurityException => e
+        logger.warn('RASP threw security exception in prefilter', e)
+        raise e
+      rescue StandardError => e
+        logger.error('Unexpected exception during prefilter', e)
+      end
+
+      # The filtering that needs occur after the application has acted on the request and the response
+      # has been created. The main actions here are analyzing the response for unsafe state or actions.
+      def postfilter
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        # TODO: RUBY-801 We shouldn't be responsible for knowing what modes are enabled
+        return unless context.analyze_response? || PROTECT.enabled?
+
+        logger.trace_with_time('Running postfilter...') do
+          map { |rule| rule.postfilter(context) }
+        end
+      rescue Contrast::SecurityException => e
+        logger.warn('RASP threw security exception in postfilter', e)
+        raise e
+      rescue StandardError => e
+        logger.error('Unexpected exception during postfilter', e)
+      end
+    end
+  end
+end

data/lib/contrast/agent/scope.rb

@@ -99,12 +99,6 @@ module Contrast
         send(call)
       end
 
-      def with_scope name, &block
-        cs__class.ensure_valid_scope! name
-        call = with_contrast_scope { :"with_#{ name }_scope" }
-        send(call, &block)
-      end
-
       class << self
         def valid_scope? scope_sym
           Contrast::Agent::Scope::SCOPE_LIST.include? scope_sym

data/lib/contrast/agent/service_heartbeat.rb

@@ -16,10 +16,9 @@ module Contrast
 
       def updater_thread
         @_updater_thread ||= Contrast::Agent::Thread.new do
-          logger.debug(nil, 'Starting heartbeat thread.')
+          logger.info('Starting heartbeat thread.')
           loop do
             begin
-              logger.debug(nil, 'Sending Heartbeat...')
               CONTRAST_SERVICE.queue_message(poll_message)
             end
             sleep REFRESH_INTERVAL_SEC

data/lib/contrast/agent/settings_state.rb

@@ -3,21 +3,12 @@
 
 cs__scoped_require 'securerandom'
 cs__scoped_require 'set'
+cs__scoped_require 'singleton'
 
-cs__scoped_require 'contrast/utils/assess/sampling_util'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'contrast/utils/environment_util'
-cs__scoped_require 'contrast/utils/env_configuration_item'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/performs_logging'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/agent/reaction_processor'
-cs__scoped_require 'contrast/agent/require_state'
-cs__scoped_require 'contrast/agent/assess/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
 cs__scoped_require 'contrast/components/interface'
 
+cs__scoped_require 'contrast/agent/reaction_processor'
+
 module Contrast
   module Agent
     # This class functions as a way to query the Agent for its current
@@ -27,19 +18,12 @@ module Contrast
     #
     # @abstract Use the methods in FeatureState to access this data
     class SettingsState
-      include Contrast::Utils::PerformsLogging
       include Contrast::Components::Interface
 
-      INVALID_CONFIG = '!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!'
-
       access_component :agent, :analysis, :settings, :config, :contrast_service
 
-      MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
-
       # These are components.
-      attr_accessor :last_update,
-                    :log_file,
-                    :log_level
+      attr_accessor :last_update
 
       # These represent process-level attributes,
       # not directly related to Contrast function itself.
@@ -57,11 +41,7 @@ module Contrast
         @pid  = Process.pid.to_i
         @ppid = Process.ppid.to_i
 
-        init_log_queueing
-
         check_config
-
-        flush_log_queues
       end
 
       def check_config
@@ -69,29 +49,15 @@ module Contrast
 
         if CONFIG.invalid?
           AGENT.disable!
-          self.class.log_error(INVALID_CONFIG)
-          abort_log_queues
-          elseif CONFIG.disabled?
+          logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
+        elsif CONFIG.disabled?
           AGENT.disable!
-          self.class.log_warn(LOG_CONFIGURATION_DISABLED)
+          logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
           AGENT.enable!
         end
       end
 
-      # workaround to mixed use of class/instance
-      def self.logger
-        instance.logger
-      end
-
-      def logger
-        logger_manager.current
-      end
-
-      def logger_manager
-        (@_logger_manager ||= Contrast::Agent::LoggerManager.new.tap(&:update))
-      end
-
       def assess_rule name
         ASSESS.rule name
       end
@@ -105,48 +71,18 @@ module Contrast
           @instrumented_packages[package] = true
         end
 
-        self.class.debug_with_time("instrumenting #{ package }") do
+        logger.trace_with_time("instrumenting #{ package } ") do
           cs__scoped_require(package)
         end
       rescue LoadError, StandardError => e
         @instrumented_packages[package] = false
-        self.class.log_error("[e.class: #{ e.class }] unable to instrument: #{ package }", e)
+        logger.error("failed instrumenting #{ package } ", e)
       end
 
+      # Test only
       def protect_rule name
         PROTECT.rule name
       end
-
-      def send_inventory_message
-        return unless INVENTORY.enabled?
-
-        app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.new
-
-        # TODO: RUBY-770
-        Contrast::Utils::EnvironmentUtil.add_library_to_app_update(app_update_msg, protobuf_format(CONFIG.root.inventory.tags))
-
-        Contrast::Delegators::ApplicationUpdate.new(app_update_msg).instance_eval do
-          append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies) if INVENTORY.enabled?
-          append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data) if INVENTORY.enabled?
-          append_platform_version(Contrast::Agent.framework_manager.platform_version)
-        end
-
-        Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
-
-        CONTRAST_SERVICE.queue_message app_update_msg
-      end
-
-      def present? str
-        Contrast::Utils::EnvironmentUtil.present?(str)
-      end
-
-      # CONTRAST-35326, move this responsibility toward the protobuf object
-      def protobuf_format param, truncate: true
-        param = param&.to_s
-        param = Contrast::Utils::StringUtils.force_utf8(param)
-        param = Contrast::Utils::StringUtils.truncate(param) if truncate
-        param
-      end
     end
   end
 end

data/lib/contrast/agent/socket_client.rb

@@ -17,9 +17,9 @@ module Contrast
     class SocketClient
       include Contrast::Components::Interface
 
-      access_component :logging, :contrast_service, :app_context
+      access_component :app_context, :contrast_service, :logging
 
-      attr_accessor :speedracer, :status
+      attr_reader :speedracer, :status
 
       def initialize
         @status = Contrast::Api::ConnectionStatus.new
@@ -68,7 +68,9 @@ module Contrast
         end
       rescue StandardError => e
         status.failure!
-        logger.error(e, "Unable to send #{ event.cs__class } message #{ event.__id__ }.")
+        logger.error('Unable to send message.', e,
+                     event_id: event.__id__,
+                     event_type: event.cs__class.name)
         nil
       end
 
@@ -85,10 +87,10 @@ module Contrast
       # we've attempted to start it up.
       def start_or_restart
         if restart?
-          logger.info(nil, 'Attempting to restart service.')
+          logger.info('Attempting to restart service.')
           return speedracer.start_service
         elsif !status.was_connected?
-          logger.info(nil, 'Attempting to start service.')
+          logger.info('Attempting to start service.')
           return speedracer.start_service
         end
 
@@ -102,27 +104,31 @@ module Contrast
         # 1 initial attempt, + 3 potential retries.
         # The agent-service-api REQUIREMENTS.md spec mandates this #.
         4.times do
-          # TODO: RUBY-794 make Type & ID structured for parsing)
-          logger.debug("Immediately sending #{ agent_startup_msg.cs__class.name } event #{ agent_startup_msg.__id__ }.")
+          log_send_event(agent_startup_msg)
           next unless (agent_response = speedracer.send_one(agent_startup_msg))
 
           # Connection was successful
-          # TODO: RUBY-794 make Type & ID structured for parsing)
-          logger.debug("Immediately sending #{ app_startup_msg.cs__class.name } event #{ app_startup_msg.__id__ }.")
+          log_send_event(app_startup_msg)
           app_response = speedracer.send_one(app_startup_msg)
           [agent_response, app_response].each do |msg|
             Contrast::Utils::ServiceResponseUtil.process_response msg
           end
           status.success!
-          logger.debug(nil, 'Successfully sent startup messages to service.')
+          logger.debug('Successfully sent startup messages to service.')
           return
         end
 
         logger.error('Could not send agent startup message context')
       rescue StandardError => e
-        logger.error(e, 'Could not build service context')
+        logger.error('Could not build service context', e)
         raise # re-raise the error to be caught by SocketClient#send_to_speedracer
       end
+
+      def log_send_event event
+        logger.debug('Immediately sending event.',
+                     event_id: event.__id__,
+                     event_type: event.cs__class.name)
+      end
     end
   end
 end

data/lib/contrast/agent/static_analysis.rb

@@ -0,0 +1,42 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/gemfile_reader'
+cs__scoped_require 'contrast/api/decorators/application_update'
+
+module Contrast
+  module Agent
+    # this module handles one time static analysis tasks
+    class StaticAnalysis
+      include Singleton
+      include Contrast::Components::Interface
+      access_component :logging, :analysis, :contrast_service, :scope
+      class << self
+        # After the first request is complete, we do a one-time manual catchup to review and
+        # report the already-loaded gems.
+        def catchup
+          @_catchup ||= begin
+                          with_contrast_scope do
+                            Contrast::Utils::GemfileReader.instance.map_loaded_classes
+                            send_inventory_message
+                            true
+                          end
+                        end
+        rescue StandardError => e
+          logger.warn('Unable to run post-initialization static analysis', e)
+        end
+
+        def send_inventory_message
+          return unless INVENTORY.enabled?
+
+          app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
+
+          Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
+
+          CONTRAST_SERVICE.queue_message app_update_msg
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/thread.rb

@@ -9,7 +9,7 @@ module Contrast
     class Thread < ::Thread
       include Contrast::Components::Interface
 
-      access_component :logging, :scope
+      access_component :scope
 
       # Make our internal code run in Contrast scope.
       def initialize *args

data/lib/contrast/agent/tracepoint_hook.rb

@@ -12,10 +12,6 @@ module Contrast
       access_component :logging, :scope
 
       class << self
-        def active?
-          instance_variable_defined?(:@require_hook) && @require_hook.enabled?
-        end
-
         def enable!
           @require_hook ||= TracePoint.new(:end) do |tracepoint_event|
             process(tracepoint_event)
@@ -33,7 +29,7 @@ module Contrast
 
         def process tracepoint_event
           with_contrast_scope do
-            logger.debug("Received end event for #{ tracepoint_event.self }")
+            logger.trace('Received TracePoint end event', module: tracepoint_event.self.to_s)
 
             loaded_module = tracepoint_event.self
             path = tracepoint_event.path

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.10.2'
+    VERSION = '3.11.0'
   end
 end

data/lib/contrast/api.rb

@@ -12,7 +12,7 @@ end
 
 cs__scoped_require 'contrast/api/dtm_pb'
 cs__scoped_require 'contrast/api/settings_pb'
-cs__scoped_require 'contrast/delegators'
+cs__scoped_require 'contrast/api/decorators'
 cs__scoped_require 'contrast/api/unix_socket'
 cs__scoped_require 'contrast/api/tcp_socket'
 cs__scoped_require 'contrast/api/speedracer'

data/lib/contrast/api/decorators.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to decorate protobuf models
+    module Decorators
+    end
+  end
+end
+cs__scoped_require 'contrast/api/decorators/application_update'
+cs__scoped_require 'contrast/api/decorators/input_analysis'
+cs__scoped_require 'contrast/api/decorators/application_settings'
+cs__scoped_require 'contrast/api/decorators/server_features'

data/lib/contrast/api/decorators/application_settings.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationSettings protobuf model to handle setting translation
+      module ApplicationSettings
+        MODE_ALLOWLIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        # Convert protobuf exlcusions into Agent exclusions
+        def translated_exclusions
+          exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
+        end
+
+        # Convert protobuf protect rule settings into a hash that settings state understands
+        def translated_protection_mode_by_id
+          protection_rules = self.protection_rules.map { |pr, _hash| [pr.id, pr.mode] } # [[RULE_ID, MODE]]
+          protection_rules.select! { |(_id, mode)| MODE_ALLOWLIST.include? mode } # [REMOVE IF MODE INVALID]
+          protection_rules.to_h # {RULE_ID => MODE}
+        end
+
+        def application_state_translation
+          {
+              modes_by_id: translated_protection_mode_by_id,
+              exclusion_matchers: translated_exclusions,
+              disabled_assess_rules: disabled_assess_rules,
+              session_id: session_id
+          }
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::ApplicationSettings.include(Contrast::Api::Decorators::ApplicationSettings)

data/lib/contrast/api/decorators/application_update.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
+      # AppUpdate dtm
+      module ApplicationUpdate
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_view_technology_descriptor_data view_technology_descriptors
+          view_technology_descriptors.each do |vtd|
+            vtd.technology_names.each do |tech_name|
+              technologies[tech_name] = true
+            end
+          end
+        end
+
+        def append_library_update library_dtm_list, library_tags
+          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+          library_dtm_list.each do |library_dtm|
+            library_dtm.tags = lib_tags
+            libraries[library_dtm.hash_code] = library_dtm
+          end
+        end
+
+        # TS only allows you to report 500 routes per application
+        def append_route_coverage_data route_coverage_dtms
+          route_coverage_dtms.take(500).each do |route_coverage_dtm|
+            routes << route_coverage_dtm
+          end
+        end
+
+        def append_platform_version platform_version
+          self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
+          platform.major = platform_version.major
+          platform.minor = platform_version.minor
+          platform.build = platform_version.patch
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build
+            msg = new
+            msg.append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies)
+            msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
+            msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
+            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)