contrast-agent 3.10.2 → 3.11.0

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -6,6 +6,7 @@ module Contrast
     # Used to define common locations and extensions for specific technologies
     class ViewTechnologiesDescriptor
       attr_reader :path, :extension, :technology_names
+
       def initialize path, extension, technology_names
         @path = path
         @extension = extension

data/lib/contrast/tasks/service.rb

@@ -33,14 +33,8 @@ module Contrast
 
     # Stop the service if it is running
     def self.stop_service
-      if Contrast::Utils::OS.windows?
-        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
-        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
-        `Taskkill /PID #{ pid } /F` if pid
-      else
-        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
-        `kill #{ pid }` if pid
-      end
+      pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
+      `kill #{ pid }` if pid
     end
 
     namespace :contrast do

data/lib/contrast/utils/assess/sampling_util.rb

@@ -19,7 +19,8 @@ module Contrast
         end
 
         def update
-          @enabled            = self.class.sampling_control[:enabled]
+          self.class.reset_sampling_control
+          @enabled            = self.class.sampling_enabled?
           @baseline           = self.class.sampling_control[:baseline]
           @request_frequency  = self.class.sampling_control[:request_frequency]
           @response_frequency = self.class.sampling_control[:response_frequency]
@@ -28,10 +29,6 @@ module Contrast
           true
         end
 
-        def reset
-          @requests.clear
-        end
-
         def sample? request
           history = request_history(request)
           history.hit
@@ -64,20 +61,18 @@ module Contrast
 
         # RequestHistory tracks one requests history per time window
         class RequestHistory
-          attr_accessor :window_start, :total_hit, :window_hit
+          attr_reader :window_start, :window_hit
 
           def initialize
             @window_start = Contrast::Utils::Timer.now_ms
-            @total_hit = 0
             @window_hit = 0
           end
 
           def elapsed
-            Contrast::Utils::Timer.now_ms - @window_start
+            Contrast::Utils::Timer.now_ms - window_start
           end
 
           def hit cnt = 1
-            @total_hit += cnt
             @window_hit += cnt
           end
 

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,11 +1,17 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
+        include Contrast::Components::Interface
+
+        access_component :logging
+
         def self.tracked? obj
           return false if obj.nil?
 
@@ -28,7 +34,7 @@ module Contrast
           # This is used to ask if a ton of objects are tracked. They may not
           # all be iterable. Bad things could happen in some cases, like when
           # checking a closed statement for SQL injection trigger events
-          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
+          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
           false
         end
       end

data/lib/contrast/utils/boolean_util.rb

@@ -10,17 +10,17 @@ module Contrast
     class BooleanUtil
       class << self
         def false? config
-          return false unless config
           return false if config == true
           return true if config == false
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
         end
 
         def true? config
-          return false unless config
           return false if config == false
           return true if config == true
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
         end

data/lib/contrast/utils/cache.rb

@@ -10,17 +10,6 @@ module Contrast
         @data = {}
       end
 
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
       def [] key
         found = true
         value = @data.delete(key) { found = false }

data/lib/contrast/utils/class_util.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
@@ -56,7 +57,8 @@ module Contrast
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
           if object.cs__is_a?(String)
-            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+            cached = to_cached_string(object)
+            return cached if cached
 
             object.dup
           elsif object.cs__is_a?(Symbol)
@@ -65,6 +67,8 @@ module Contrast
             object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -107,6 +111,21 @@ module Contrast
 
           mod
         end
+
+        # If the String matches a common String in our ObjectShare, return that
+        # rather that for use as the representation of the String rather than
+        # forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast
+        #   representation.
+        # @return [String,nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
+
+          nil
+        end
       end
     end
   end

data/lib/contrast/utils/gemfile_reader.rb

@@ -15,7 +15,7 @@ module Contrast
       include Singleton
       include Contrast::Components::Interface
 
-      access_component :logging
+      access_component :config, :logging
 
       CONTRAST_AGENT = 'contrast-agent'
 
@@ -55,9 +55,10 @@ module Contrast
           paths = get_by_digest(digest)
           path = spec.full_gem_path
           $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
+            next unless line.cs__is_a?(String)
+            next unless line.start_with?(path)
 
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
+            logger.trace('Recording loaded gem for inventory analysis', line: line)
             updated!
             paths << adjust_lib(line)
           end
@@ -137,6 +138,7 @@ module Contrast
         lib.external_ms = date_to_ms(spec.date)
         lib.internal_ms = lib.external_ms
         lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
+        # Library tags are appended in the ApplicationUpdate delegator
         update_class_counts(lib, digest, spec)
         lib
       end

data/lib/contrast/utils/hash_digest.rb

@@ -136,10 +136,6 @@ module Contrast
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
-      def reset
-        @crc32 = 0
-      end
-
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil
       include Contrast::Components::Interface
-      access_component :logging, :heap_dump
+      access_component :heap_dump, :logging
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'
@@ -25,12 +25,13 @@ module Contrast
 
           delay = heap_dump_control[:delay]
           Contrast::Agent::Thread.new do
-            logger.info("HEAP DUMP THREAD INITIALIZED.  WAITING #{ delay } SECONDS TO BEGIN.")
+            logger.info("HEAP DUMP THREAD INITIALIZED. WAITING #{ delay } SECONDS TO BEGIN.")
             sleep(delay)
             capture_heap_dump
           end
         rescue StandardError => e
           logger.info(LOG_ERROR_DUMPS, e)
+          nil
         end
 
         def log_enabled_warning
@@ -79,21 +80,21 @@ module Contrast
           window = heap_dump_control[:window]
           count  = heap_dump_control[:count]
           clean  = heap_dump_control[:clean]
-          logger.info(nil, 'HEAP DUMP MAIN LOOP')
+          logger.info('HEAP DUMP MAIN LOOP')
           ObjectSpace.trace_object_allocations_start
           count.times do |i|
-            logger.info(nil, "STARTING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+            logger.info('STARTING HEAP DUMP PASS', current_pass: i + 1, max: count)
             output = "#{ Time.now.to_f }-heap.dump"
             output = File.join(dir, output)
             begin
-              logger.info(nil, "OPENING FILE #{ dir }/#{ output } FOR HEAP DUMP")
+              logger.info('OPENING HEADUMP FILE', dir: dir, file: output)
               file = File.new(output, FILE_WRITE_FLAGS)
               if clean
-                logger.info(nil, 'PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
+                logger.info('PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
                 GC.start
               end
               ObjectSpace.dump_all(output: file)
-              logger.info(nil, "FINISHING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+              logger.info('FINISHING HEAP DUMP PASS', current_pass: i + 1, max: count)
             ensure
               file.close
             end
@@ -101,10 +102,10 @@ module Contrast
           end
         ensure
           ObjectSpace.trace_object_allocations_stop
-          logger.info(nil, '*****************************************************')
-          logger.info(nil, '********        HEAP DUMP HAS CONCLUDED      ********')
-          logger.info(nil, '***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
-          logger.info(nil, '*****************************************************')
+          logger.info('*****************************************************')
+          logger.info('********        HEAP DUMP HAS CONCLUDED      ********')
+          logger.info('***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
+          logger.info('*****************************************************')
           exit # We weren't kidding!
         end
       end

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -54,7 +54,7 @@ module Contrast
           Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
         end
       rescue StandardError => e
-        logger.error(e, "Unable to build a finding for #{ rule_id }")
+        logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private

data/lib/contrast/utils/inventory_util.rb

@@ -29,7 +29,7 @@ module Contrast
       def self.inventory_class class_path
         Contrast::Utils::GemfileReader.instance.map_class(class_path)
       rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
+        logger.error('Unable to inventory module', e, path: class_path)
       end
 
       def self.active_record_config
@@ -56,7 +56,7 @@ module Contrast
           activity_or_update.technologies[a.vendor] = true
         end
       rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
+        logger.error('Unable to append db config', e)
         nil
       end
 

data/lib/contrast/utils/io_util.rb

@@ -11,16 +11,6 @@ module Contrast
 
       access_component :logging
 
-      # StringIO is a valid path because it logs directly to a string buffer
-      def self.write_permission? path
-        return false if path.nil?
-        return true if path.is_a?(StringIO)
-        return File.writable?(path) if File.exist?(path)
-
-        dir_name = File.dirname(File.absolute_path(path))
-        File.writable?(dir_name)
-      end
-
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
       # all others.
@@ -30,7 +20,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug(e, "Encountered an issue inspecting instance of #{ potential_io } - continuing without rewind")
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -17,7 +17,7 @@ module Contrast
         def sidekiq_running?
           return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
 
-          logger.debug(nil, 'Detected the spawn of a Sidekiq process')
+          logger.trace('Detected the spawn of a Sidekiq process')
           true
         end
 
@@ -30,7 +30,7 @@ module Contrast
           has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
           return false unless has_disabled_task
 
-          logger.debug(nil, 'Detected startup within Rake task')
+          logger.trace('Detected startup within Rake task')
           true
         end
       end

data/lib/contrast/utils/object_share.rb

@@ -10,8 +10,6 @@ module Contrast
     class ObjectShare
       # Strings
       AND =           '&'
-      OR =            '||'
-      PIPE =          '|'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
@@ -27,8 +25,7 @@ module Contrast
       NEW_LINE =      "\n"
       NIL_STRING =    'nil'
       PERIOD =        '.'
-      PLUS_SIGN =     '+'
-      POUND_SIGN = HASH_CHAR = '#'
+      POUND_SIGN =    '#'
       QUESTION_MARK = '?'
       RETURN =        "\r"
       SEMICOLON =     ';'
@@ -39,35 +36,17 @@ module Contrast
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'
       LEFT_ANGLE =    '<'
-      RIGHT_ANGLE =   '>'
-      LEFT_BRACKET =   '['
-      RIGHT_BRACKET =  ']'
-      LEFT_PAREN =     '('
-      RIGHT_PAREN =    ')'
       COLON_SLASH_SLASH = '://'
-      TICK =           '`'
-      BACK_TICK =      '`'
-      LEFT_CURLY =     '{'
-      RIGHT_CURLY =    '}'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
-      PERCENT =        '%'
-      LETTER_Q =       'Q'
-      OR_STRING =      'or'
 
-      DOUBLE_QUOTE_ESCAPED = '&quot;'
-
-      READ_FLAG =     'r'
       WRITE_FLAG =    'w'
-      READ_WRITE_FLAG = 'rw'
 
       PARENT_PATH =   '..'
 
       RUBY = 'Ruby'
       CACHE = 'cache'
-      GEM_SUFFIX = '.gem'
 
-      CONTRAST_METHOD_START = 'cs__'
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
       CONTRAST_MODULE_START = 'Contrast::'
       ANONYMOUS_CLASS_MARKER = '#<'
@@ -75,13 +54,11 @@ module Contrast
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze
-      EMPTY_TRIPLE = [EMPTY_STRING, EMPTY_STRING, EMPTY_STRING].freeze
 
       # RegExps
       DIGIT_REGEXP =       /[[:digit:]]/.freeze
       WHITE_SPACE_REGEXP = /\s/.freeze
       NOT_WHITE_SPACE_REGEXP = /[^\s]/.freeze
-      WINDOWS_REGEXP = /cygwin|mswin|mingw|bccwin|wince|emx/.freeze
 
       # Messages
       OVERRIDE_MESSAGE = 'A security filter prevented original response from being returned.'
@@ -93,10 +70,7 @@ module Contrast
       CLASS = 'Class'
       MODULE = 'Module'
 
-      BRACKET_INTERPOLATION_START = '#{'
-
       OBJECT_KEY = 'O'
-      PARAMETER_KEY = 'P'
       RETURN_KEY = 'R'
       UNKNOWN = 'unknown'
 

data/lib/contrast/utils/os.rb

@@ -8,32 +8,8 @@ module Contrast
     # Utility memozies to avoid multiple lookups.
     module OS
       class << self
-        def windows?
-          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil? if @_windows.nil?
-          @_windows
-        end
-
-        def mac?
-          @_mac ||= !(/darwin/ =~ RUBY_PLATFORM).nil? if @_mac.nil?
-          @_mac
-        end
-
-        def unix?
-          @unix ||= !windows? if @_unix.nil?
-          @unix
-        end
-
-        def linux?
-          @_linux ||= unix? && !OS.mac? if @_linux.nil?
-          @_linux
-        end
-
         def running?
-          process = if Contrast::Utils::OS.windows?
-                      `tasklist /fi "imagename eq contrast-service.exe"`
-                    else
-                      `ps aux | grep contrast-servic[e]`
-                    end
+          process = `ps aux | grep contrast-servic[e]`
           process != ''
         end