contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/logger/application.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Logger
+    # # Our decorator for the Ougai logger allowing for the logging of the
+    # application environment, used to provide context during troubleshooting.
+    module Application
+      include Contrast::Components::Interface
+      access_component :config
+
+      ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
+      # Utility method to log some current ruby and rails information from environment
+      def application_environment
+        return unless info?
+
+        info('Process environment information',
+             p_id: Process.pid,
+             pp_id: Process.ppid,
+             agent_version: Contrast::Agent::VERSION)
+        ENV.each do |env_key, env_value|
+          env_key = env_key.to_s
+          next unless ENV_KEYS.include?(env_key) ||
+              (env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) &&
+                  !env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER + 'API'))
+
+          info('Environment settings', key: env_key, value: env_value)
+        end
+      end
+
+      def application_configuration
+        return unless info?
+
+        loggable = CONFIG.raw.send(:load_config)
+        loggable.delete('api')
+        info('Current configuration', configuration: JSON.pretty_generate(loggable))
+      end
+
+      def application_libraries
+        if debug?
+          log_all_libraries
+        elsif info?
+          log_specific_libraries
+        end
+      end
+
+      FRAMEWORKS = %w[rails sinatra grape].cs__freeze
+      WEB_SERVERS = %w[agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn webrick yarn].cs__freeze
+      LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
+      def log_specific_libraries
+        FRAMEWORKS.each(&cs__method(:log_gem_data))
+        WEB_SERVERS.each(&cs__method(:log_gem_data))
+        LIBRARIES.each(&cs__method(:log_gem_data))
+      end
+
+      private
+
+      def log_all_libraries
+        return unless debug?
+
+        Gem.loaded_specs.each_pair do |_name, gem_spec|
+          debug('Gem loaded',
+                gem_name: gem_spec.name,
+                gem_version: gem_spec.version.to_s)
+        end
+      end
+
+      def log_gem_data gem_name
+        gem_spec = Gem.loaded_specs[gem_name]
+        return unless gem_spec
+
+        info('Gem loaded',
+             gem_name: gem_spec.name,
+             gem_version: gem_spec.version.to_s)
+      end
+    end
+  end
+end

data/lib/contrast/logger/format.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'ougai'
+cs__scoped_require 'contrast/utils/thread_tracker'
+
+module Contrast
+  module Logger
+    # Our format for the Ougai logger allowing for custom log format that
+    # extends the behavior of the default Ougai logger
+    class Format < Ougai::Formatters::Bunyan
+      LOG_TRACKER = Contrast::Utils::ThreadTracker.new
+      # Our override of the _call method to add in the extra data that we want,
+      # based on
+      # https://github.com/tilfin/ougai/blob/1fe4fc2587be8eabc47d36dc57ee2814f8a0162b/lib/ougai/formatters/bunyan.rb#L26
+      # By default, it adds:
+      #   name: progname || @app_name,
+      #   hostname: @hostname,
+      #   pid: $$,
+      #   level: to_level(severity),
+      #   time: time,
+      #   v: 0
+      # and we add the fields from #format_hash
+      def _call severity, time, progname, data
+        super(severity,
+              time,
+              progname,
+              format_hash.merge(data)
+        )
+      end
+
+      private
+
+      # The extra values to add to the Bunyan hash. Because this is unique per
+      # thread, we'll create it once and then store it, rather than create a
+      # new hash on every log call.
+      # @return [Hash{Symbol => Object}] the extra data to log
+      #   tid: current thread id
+      def format_hash
+        hash = LOG_TRACKER.get(:thread_id_hash)
+        unless hash
+          hash = {
+              tid: Thread.current.object_id
+          }
+          LOG_TRACKER.set(:thread_id_hash, hash)
+        end
+        hash
+      end
+    end
+  end
+end

data/lib/contrast/logger/log.rb

@@ -0,0 +1,149 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'logger'
+cs__scoped_require 'ougai'
+cs__scoped_require 'singleton'
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/logger/application'
+cs__scoped_require 'contrast/logger/format'
+cs__scoped_require 'contrast/logger/time'
+
+module Contrast
+  module Logger
+    # This class functions to serve as a wrapper around our logging, as we need
+    # to be able to dynamically update level based on updates to TeamServer.
+    class Log
+      include Singleton
+      include Contrast::Components::Interface
+      access_component :config
+
+      DEFAULT_NAME     = 'contrast.log'
+      DEFAULT_LEVEL    = ::Ougai::Logging::Severity::INFO
+      VALID_LEVELS     = ::Ougai::Logging::Severity::SEV_LABEL
+      STDOUT_STR       = 'STDOUT'
+      STDERR_STR       = 'STDERR'
+
+      attr_reader :previous_path,
+                  :previous_level
+
+      def initialize
+        update
+      end
+
+      # Given new settings from TeamServer, update our logging to use the new
+      # file and level, assuming they weren't set by local configuration.
+      #
+      # @param log_file [String] the file to which to log
+      # @param log_level [String] the level at which to log
+      def update log_file = nil, log_level = nil
+        config = CONFIG.root.agent.logger
+
+        config_path  = config.path&.length.to_i.positive? ? config.path : nil
+        config_level = config.level&.length&.positive? ? config.level : nil
+
+        # config > settings > default
+        path        = valid_path(config_path   || log_file)
+        level_const = valid_level(config_level || log_level)
+
+        # don't needlessly recreate logger
+        return if @_logger && (path == previous_path) && (level_const == previous_level)
+
+        @previous_path  = path
+        @previous_level = level_const
+
+        @_logger = build(path: path, level_const: level_const)
+        log_update
+      rescue StandardError => e
+        if logger
+          logger.error('Unable to process update to LoggerManager.', e)
+        else
+          puts 'Unable to process update to LoggerManager.'
+          puts e.backtrace.join("\n")
+        end
+      end
+
+      def logger
+        @_logger
+      end
+
+      # StringIO is a valid path because it logs directly to a string buffer
+      def write_permission? path
+        return false if path.nil?
+        return true if path.is_a?(StringIO)
+        return File.writable?(path) if File.exist?(path)
+
+        dir_name = File.dirname(File.absolute_path(path))
+        File.writable?(dir_name)
+      end
+
+      private
+
+      def build path: STDOUT_STR, level_const: DEFAULT_LEVEL
+        logger = case path
+                 when STDOUT_STR, STDERR_STR
+                   ::Ougai::Logger.new(Object.cs__const_get(path))
+                 else
+                   ::Ougai::Logger.new(path)
+                 end
+        add_contrast_loggers(logger)
+        logger.progname = 'Contrast Agent'
+        logger.level = level_const
+        logger.formatter = Contrast::Logger::Format.new
+        logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
+        logger
+      end
+
+      def add_contrast_loggers logger
+        logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Time)
+      end
+
+      def valid_path path
+        path = path.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : path
+        return path if path == STDOUT_STR
+        return path if path == STDERR_STR
+
+        path = DEFAULT_NAME if path.empty?
+        if write_permission?(path)
+          path
+        elsif write_permission?(DEFAULT_NAME)
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
+          DEFAULT_NAME
+        else
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead." if previous_path != STDOUT_STR
+          STDOUT_STR
+        end
+      end
+
+      def valid_level level
+        level ||= DEFAULT_LEVEL
+        level = level.upcase
+        if VALID_LEVELS.include?(level)
+          Object.cs__const_get("::Ougai::Logging::Severity::#{ level }")
+        else
+          DEFAULT_LEVEL
+        end
+      rescue StandardError
+        DEFAULT_LEVEL
+      end
+
+      # Log that the Agent log has changed and include some default information
+      # at the start of the log.
+      def log_update
+        logger.debug('Initialized new contrast agent logger')
+        logger.debug_with_time('middleware: log environment') do
+          logger.application_environment
+          logger.application_configuration
+          logger.application_libraries
+        end
+      end
+    end
+  end
+end

data/lib/contrast/logger/time.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for timing and with_level
+    # methods.
+    module Time
+      # Log the message at the given level.
+      #
+      # @param level [String] the name of the method to use. Should be one of
+      #   trace, debug, info, warn, error
+      # @param message [String] the message to log
+      def with_level level, message
+        send(level.to_sym, message)
+      end
+
+      # Log, at the debug level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def debug_with_time *msgs, &block
+        log_with_time(:debug, *msgs, &block)
+      end
+
+      # Log, at the trace level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def trace_with_time *msgs, &block
+        log_with_time(:trace, *msgs, &block)
+      end
+
+      private
+
+      def log_with_time level, *msgs
+        a = Contrast::Utils::Timer.now_ms
+        ret = yield if block_given?
+        z = Contrast::Utils::Timer.now_ms
+        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
+        send(level, *msgs)
+        ret
+      end
+    end
+  end
+end

data/lib/contrast/tasks/config.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'yaml'
+
+module Contrast
+  # A Rake task to generate a contrast_security.yaml file with some basic settings
+  module Config
+    extend Rake::DSL
+    include Contrast::Components::Interface
+    DEFAULT_CONFIG = {
+        'api' => {
+            'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',
+            'api_key' => 'Enter your Contrast api key',
+            'service_key' => 'Enter your Contrast service key',
+            'user_name' => 'Enter your Contrast user name'
+        },
+        'agent' => {
+            'service' => {
+                'logger' => {
+                    'path' => 'contrast_service.log',
+                    'level' => 'ERROR' # DEBUG | INFO | WARN | ERROR
+                },
+                'socket' => '/tmp/contrast_service.sock'
+            },
+            'logger' => {
+                'level' => 'ERROR',
+                'path' => 'contrast_agent.log'
+            }
+        }
+    }.cs__freeze
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Create a contrast_security.yaml in the applications root directory'
+        task :create do
+          execution_directory = Dir.pwd
+          target_path = File.join(execution_directory, 'contrast_security.yaml')
+          if File.exist?(target_path)
+            puts 'WARNING: contrast_security.yaml already exists'
+          else
+            File.open(target_path, 'w') do |f|
+              f.write(YAML.dump(DEFAULT_CONFIG))
+            end
+
+            puts "Created contrast_security.yaml at #{ target_path }"
+            puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
+            puts 'Visit our documentation site for more details: https://docs.contrastsecurity.com/installation-rubyconfig.html'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/tasks/service.rb

@@ -33,14 +33,8 @@ module Contrast
 
     # Stop the service if it is running
     def self.stop_service
-      if Contrast::Utils::OS.windows?
-        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
-        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
-        `Taskkill /PID #{ pid } /F` if pid
-      else
-        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
-        `kill #{ pid }` if pid
-      end
+      pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
+      `kill #{ pid }` if pid
     end
 
     namespace :contrast do
@@ -49,8 +43,6 @@ module Contrast
         task :start do
           if Contrast::Utils::OS.running?
             puts 'Contrast Service already running. No need to start'
-          elsif !CONTRAST_SERVICE.enabled?
-            puts 'Contrast Service disabled by configuration. Not starting.'
           else
             start_service
           end
@@ -64,10 +56,8 @@ module Contrast
         task :status do
           if Contrast::Utils::OS.running?
             puts 'online'
-          elsif CONTRAST_SERVICE.enabled?
-            puts 'offline'
           else
-            puts 'disabled'
+            puts 'offline'
           end
         end
       end

data/lib/contrast/utils/assess/sampling_util.rb

@@ -19,7 +19,8 @@ module Contrast
         end
 
         def update
-          @enabled            = self.class.sampling_control[:enabled]
+          self.class.reset_sampling_control
+          @enabled            = self.class.sampling_enabled?
           @baseline           = self.class.sampling_control[:baseline]
           @request_frequency  = self.class.sampling_control[:request_frequency]
           @response_frequency = self.class.sampling_control[:response_frequency]
@@ -28,10 +29,6 @@ module Contrast
           true
         end
 
-        def reset
-          @requests.clear
-        end
-
         def sample? request
           history = request_history(request)
           history.hit
@@ -64,20 +61,18 @@ module Contrast
 
         # RequestHistory tracks one requests history per time window
         class RequestHistory
-          attr_accessor :window_start, :total_hit, :window_hit
+          attr_reader :window_start, :window_hit
 
           def initialize
             @window_start = Contrast::Utils::Timer.now_ms
-            @total_hit = 0
             @window_hit = 0
           end
 
           def elapsed
-            Contrast::Utils::Timer.now_ms - @window_start
+            Contrast::Utils::Timer.now_ms - window_start
           end
 
           def hit cnt = 1
-            @total_hit += cnt
             @window_hit += cnt
           end