contrast-agent 3.10.2 → 3.11.0

data/lib/contrast/api/decorators/exclusion.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/settings_pb'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Contrast::Api::Settings::Exclusion protobuf model
+      # to allow for renaming of fields.
+      module Exclusion
+        def denylist
+          blacklist
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::Exclusion.include(Contrast::Api::Decorators::Exclusion)

data/lib/contrast/api/decorators/input_analysis.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      module InputAnalysis
+        attr_accessor :request
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::InputAnalysis.include(Contrast::Api::Decorators::InputAnalysis)

data/lib/contrast/api/decorators/server_features.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      module ServerFeatures
+        # 'defend' is legacy for 'protect' in the dtm.
+        def protect_enabled?
+          !!defend.enabled
+        end
+
+        def assess_enabled?
+          !!assess.enabled
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::ServerFeatures.include(Contrast::Api::Decorators::ServerFeatures)

data/lib/contrast/api/speedracer.rb

@@ -12,14 +12,13 @@ module Contrast
     # to manage the bundled Service.
     class Speedracer
       include Contrast::Components::Interface
-      access_component :logging, :contrast_service, :app_context
+      access_component :app_context, :contrast_service, :logging
 
       attr_reader :client_number,
                   :host,
                   :port,
                   :socket,
-                  :connection,
-                  :messages_total
+                  :connection
 
       @instance_count = 0
       @instance_mutex = Mutex.new
@@ -53,7 +52,7 @@ module Contrast
         zombie_check
         service_starter_thread.join(5)
         is_service_started = Contrast::Utils::OS.running?
-        logger.error(nil, 'The bundled service could not be started. The agent will not function properly.') unless is_service_started
+        logger.error('The bundled service could not be started. The agent will not function properly.') unless is_service_started
         is_service_started
       end
 
@@ -72,19 +71,12 @@ module Contrast
       # check if there's a zombie service that exists, and wait on it if so.
       # currently, this only happens when trying to initialize speedracer
       def zombie_check
-        return if windows?
-
         zombie_pid_list = Contrast::Utils::OS.zombie_pids
         zombie_pid_list.each do |pid|
           Process.wait(pid.to_i)
         end
       end
 
-      def windows?
-        @_windows = Contrast::Utils::OS.windows? if @_windows.nil?
-        @_windows
-      end
-
       def determine_startup_options
         return { out: :out, err: :err } if Contrast::Agent::FeatureState.instance.service_control[:logger_path] == 'STDOUT'
 
@@ -136,11 +128,15 @@ module Contrast
         when Contrast::Api::Dtm::ObservedRoute
           message.observed_route = event
         else
-          logger.error("Unknown event type #{ event.cs__class.name } received. Unsure how to send.")
+          logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
           return
         end
-        # TODO: RUBY-794 make ID structured for parsing
-        logger.debug("Wrapping the event #{ event.__id__ } in message #{ message.__id__ } (#{ message.pid }-#{ message.message_count }.")
+        logger.debug('Wrapping event in message',
+                     msg_id: message.__id__,
+                     p_id: message.pid,
+                     msg_count: message.message_count,
+                     event_id: event.__id__,
+                     event_type: event.cs__class.name)
         message
       end
 
@@ -159,20 +155,28 @@ module Contrast
       end
 
       def send_message msg
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        logger.debug "[m__id__:#{ msg.__id__ }]\tSending message #{ msg.pid }-#{ msg.message_count }."
+        return unless msg
+
+        logger.debug('Sending message.',
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count)
         to_service = Contrast::Api::Dtm::Message.encode(msg)
         from_service = send_marshaled(to_service)
         response = Contrast::Api::Settings::AgentSettings.decode(from_service)
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        log_message = "[m__id__:#{ msg.__id__ }]\tReceived response: " \
-                      "#{ response ? response.__id__ : '[No Response]' } for " \
-                      "message #{ msg.pid }-#{ msg.message_count }."
-        logger.debug(log_message)
+        logger.debug('Received response.',
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count,
+                     response_id: response&.__id__)
         response
       rescue StandardError => e
-        # TODO: RUBY-794 make PID & Count structured for parsing
-        logger.error(e, "[m__id__:#{ msg.__id__ }]\tSending failed for message #{ msg.pid }-#{ msg.message_count }.")
+        logger.error('Sending failed for message.',
+                     e,
+                     msg_id: msg.__id__,
+                     p_id: msg.pid,
+                     msg_count: msg.message_count,
+                     response_id: response&.__id__)
         raise e # reraise to let SocketClient manage the connection
       end
 

data/lib/contrast/api/tcp_socket.rb

@@ -11,8 +11,6 @@ module Contrast
     class TcpSocket
       include Contrast::Api::Socket
 
-      LOCAL_HOSTS = %w[localhost 127.0.0.1 0.0.0.0 ::1].cs__freeze
-
       attr_reader :host, :port
 
       # Create the socket

data/lib/contrast/components/agent.rb

@@ -2,19 +2,19 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'rubygems/version'
+cs__scoped_require 'contrast/agent/rule_set'
 
 module Contrast
   module Components
     module Agent
       # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
+      # for access of the values contained in its parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :analysis, :config, :settings
 
         def enabled?
           !!@enabled
@@ -32,14 +32,20 @@ module Contrast
           @enabled = false
         end
 
-        def unavailable?
-          !enabled?
-        end
-
         def ready?
           state.agent_ready?
         end
 
+        # TODO: RUBY-797 These rules should be cached by a call from ServiceResponseUtil until we
+        # receive a newly updated rules state from TS. (Also update method description)
+        #
+        # Instead of asking specifically for assess or protect rules, we can ask agent to retrieve
+        # the correct ruleset based on enabled modes. Since these can change on a per request basis,
+        # we shouldn't memoize these.
+        def ruleset
+          Contrast::Agent::RuleSet.new(retrieve_ruleset&.values)
+        end
+
         def patch_interpolation?
           interpolation_patch_possible?
         end
@@ -49,11 +55,13 @@ module Contrast
         end
 
         def patch_yield?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield)
+          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield
         end
 
         def interpolation_enabled?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate)
+          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled
         end
 
         def report_custom_code_sysfile_access?
@@ -66,19 +74,6 @@ module Contrast
           loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
         end
 
-        # All this method chain does anymore is load the Thread patch that
-        # propagates request contexts.  That can go away RUBY-700.
-        SHARED_LIBRARIES = %w[contrast/extensions/ruby_core/thread].cs__freeze
-        def run_instrumentation
-          Contrast::Agent::FeatureState.instance.tap do |settings|
-            SHARED_LIBRARIES.each { |lib| settings.instrument lib }
-          end
-          Contrast::Agent::Patching::Policy::Patcher.patch # This acts as a catch up for everything we didn't see get loaded
-          enable_tracepoint # This handles all class loads & required instrumentation going forward
-        end
-
-        # TODO: RUBY-564: This responsibility should be extracted out of this agent component and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
         def insert_middleware app
           app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
         end
@@ -96,6 +91,16 @@ module Contrast
           @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
           @_interpolation_patch_possible
         end
+
+        def retrieve_ruleset
+          if ASSESS.enabled? && PROTECT.enabled?
+            ASSESS.rules.merge(PROTECT.rules)
+          elsif ASSESS.enabled?
+            ASSESS.rules
+          else
+            PROTECT.rules
+          end
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/app_context.rb

@@ -23,25 +23,19 @@ module Contrast
         DEFAULT_SERVER_NAME = 'localhost'
         DEFAULT_SERVER_PATH = '/'
 
-        def present? str
-          Contrast::Utils::EnvironmentUtil.present?(str)
-        end
-
         def server_type
           @_server_type ||= begin
                               tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless present?(tmp)
+                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
                               tmp
-                            rescue StandardError
-                              RACK_TYPE
                             end
         end
 
         def name
           @_name ||= begin
                        tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless present?(tmp)
+                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
                        Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
                      rescue StandardError
                        DEFAULT_APP_NAME
@@ -60,7 +54,7 @@ module Contrast
         def server_name
           @_server_name ||= begin
                               tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless present?(tmp)
+                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
                               tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
                               Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
                             rescue StandardError
@@ -71,7 +65,7 @@ module Contrast
         def server_path
           @_server_path ||= begin
                               tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless present?(tmp)
+                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
                               Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
                             rescue StandardError
                               DEFAULT_SERVER_PATH
@@ -81,34 +75,27 @@ module Contrast
         def build_app_startup_message
           msg = Contrast::Api::Dtm::ApplicationCreate.new
 
-          app_ver = if CONFIG.root.application.version.to_s.empty?
-                      Contrast::Utils::EnvironmentUtil.determine_application_version
-                    else
-                      CONFIG.root.application.version
-                    end
-
-          msg.group            = protobuf_format CONFIG.root.application.group
-          msg.tags             = protobuf_format CONFIG.root.application.tags
-          msg.app_version      = protobuf_format app_ver
-          msg.code             = protobuf_format CONFIG.root.application.code
-          msg.metadata         = protobuf_format CONFIG.root.application.metadata
+          msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
+          msg.tags             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+          msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
+          msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+          msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
           # Other fields have limits in TeamServer, the rest don't.
-          msg.session_id       = protobuf_format CONFIG.root.application.session_id,        truncate: false
-          msg.session_metadata = protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+          msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
+          msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
 
           msg
         end
 
-        LOG_BUILD_STARTUP = 'build startup message'
         def build_agent_startup_message
           msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = protobuf_format server_name
-          msg.server_path    = protobuf_format server_path
-          msg.server_type    = protobuf_format server_type
+          msg.server_name    = Contrast::Utils::StringUtils.protobuf_format server_name
+          msg.server_path    = Contrast::Utils::StringUtils.protobuf_format server_path
+          msg.server_type    = Contrast::Utils::StringUtils.protobuf_format server_type
           msg.server_version = Contrast::Agent::VERSION
-          msg.version        = protobuf_format CONFIG.root.server.version
-          msg.environment    = protobuf_format CONFIG.root.server.environment
-          msg.tags           = protobuf_format CONFIG.root.server.tags
+          msg.version        = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+          msg.environment    = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+          msg.tags           = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
           msg
         end
 
@@ -128,21 +115,9 @@ module Contrast
           @_client_id ||= [name, pgid].join('-')
         end
 
-        # TODO: RUBY-564: This responsibility should be extracted out of app_context and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
         def instrument_middleware_stack?
           !Contrast::Utils::JobServersRunning.job_servers_running?
         end
-
-        private
-
-        # TODO: RUBY-120, move this responsibility toward the protobuf object
-        def protobuf_format param, truncate: true
-          param = param&.to_s
-          param = Contrast::Utils::StringUtils.force_utf8(param)
-          param = Contrast::Utils::StringUtils.truncate(param) if truncate
-          param
-        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/config.rb

@@ -23,8 +23,7 @@ module Contrast
     # it should break LOUDLY.  Better to waste half an hour of the sysadmin's
     # time than to silently fail to deliver functionality.
     module Config
-      LOG_CONFIGURATION_DISABLED = 'Contrast disabled by configuration. Continuing without instrumentation.'
-      CONTRAST_ENV_MARKER        = 'CONTRAST__'
+      CONTRAST_ENV_MARKER = 'CONTRAST__'
 
       class Interface # :nodoc:
         def initialize
@@ -51,7 +50,8 @@ module Contrast
         end
 
         def enabled?
-          Contrast::Utils::BooleanUtil.true?(raw.enable)
+          @_enabled = !Contrast::Utils::BooleanUtil.false?(raw.enable) if @_enabled.nil?
+          @_enabled
         end
 
         def disabled?
@@ -59,11 +59,13 @@ module Contrast
         end
 
         def protect?
-          Contrast::Utils::BooleanUtil.true?(raw.protect.enable)
+          @_protect = Contrast::Utils::BooleanUtil.true?(raw.protect.enable) if @_protect.nil?
+          @_protect
         end
 
         def assess?
-          Contrast::Utils::BooleanUtil.true?(raw.assess.enable)
+          @_assess = Contrast::Utils::BooleanUtil.true?(raw.assess.enable) if @_assess.nil?
+          @_assess
         end
 
         def session_id

data/lib/contrast/components/contrast_service.rb

@@ -25,10 +25,6 @@ module Contrast
           state.service_enabled?
         end
 
-        def unavailable?
-          !enabled?
-        end
-
         def disabled?
           state.service_forcibly_disabled?
         end

data/lib/contrast/components/heap_dump.rb

@@ -16,17 +16,21 @@ module Contrast
         access_component :config
 
         def heap_dump_enabled?
-          state.heap_dump_enabled?
+          heap_dump_control[:enabled]
         end
 
         def heap_dump_control
-          {
-              path: File.absolute_path(CONFIG.root.agent.heap_dump.path),
-              count: CONFIG.root.agent.heap_dump.count.to_i,
-              window: CONFIG.root.agent.heap_dump.window_ms.to_f / 1000,
-              delay: CONFIG.root.agent.heap_dump.delay_ms.to_f / 1000,
-              clean: true?(CONFIG.root.agent.heap_dump.clean)
-          }
+          @_heap_dump_control ||= begin
+            config = CONFIG.root&.agent&.heap_dump
+            {
+                enabled: true?(config&.enable),
+                path: File.absolute_path(config&.path),
+                count: config&.count.to_i || 0,
+                window: (config&.window_ms.to_f || 0) / 1000,
+                delay: (config&.delay_ms.to_f || 0) / 1000,
+                clean: true?(config&.clean)
+            }
+          end
         end
       end
     end