contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,35 +1,66 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
-        def self.tracked? obj
-          return false if obj.nil?
+        include Contrast::Components::Interface
 
-          if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-            obj.each_pair do |k, v|
-              return true if tracked?(k)
-              return true if tracked?(v)
-            end
-            false
-          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-            obj.any? do |ele|
-              tracked?(ele) unless obj == ele
+        access_component :logging
+
+        class << self
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def tracked? obj
+            _tracked?(obj, 0)
+          end
+
+          private
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def _tracked? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _tracked?(k, idx)
+                return true if _tracked?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _tracked?(ele, idx) unless obj == ele
+              end
+            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
+              obj.cs__tracked?
+            else
+              false
             end
-          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-            obj.cs__tracked?
-          else
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
-        rescue StandardError => e
-          # This is used to ask if a ton of objects are tracked. They may not
-          # all be iterable. Bad things could happen in some cases, like when
-          # checking a closed statement for SQL injection trigger events
-          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
-          false
         end
       end
     end

data/lib/contrast/utils/boolean_util.rb

@@ -10,17 +10,17 @@ module Contrast
     class BooleanUtil
       class << self
         def false? config
-          return false unless config
           return false if config == true
           return true if config == false
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
         end
 
         def true? config
-          return false unless config
           return false if config == false
           return true if config == true
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
         end

data/lib/contrast/utils/class_util.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
@@ -55,8 +56,11 @@ module Contrast
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          if object.cs__is_a?(String)
-            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+          # Only treat object like a string if it actually is a string
+          # some subclasses of String override string methods we depend on
+          if object.cs__class == String
+            cached = to_cached_string(object)
+            return cached if cached
 
             object.dup
           elsif object.cs__is_a?(Symbol)
@@ -65,6 +69,8 @@ module Contrast
             object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -107,6 +113,21 @@ module Contrast
 
           mod
         end
+
+        # If the String matches a common String in our ObjectShare, return that
+        # rather that for use as the representation of the String rather than
+        # forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast
+        #   representation.
+        # @return [String,nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
+
+          nil
+        end
       end
     end
   end

data/lib/contrast/utils/gemfile_reader.rb

@@ -15,7 +15,7 @@ module Contrast
       include Singleton
       include Contrast::Components::Interface
 
-      access_component :logging
+      access_component :config, :logging
 
       CONTRAST_AGENT = 'contrast-agent'
 
@@ -55,9 +55,10 @@ module Contrast
           paths = get_by_digest(digest)
           path = spec.full_gem_path
           $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
+            next unless line.cs__is_a?(String)
+            next unless line.start_with?(path)
 
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
+            logger.trace('Recording loaded gem for inventory analysis', line: line)
             updated!
             paths << adjust_lib(line)
           end
@@ -91,11 +92,11 @@ module Contrast
           usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
           usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
           activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
+          # TODO: RUBY-882 once TS switches to take filenames, remove the count setter and
           #   send the class names in usage.class_names
           usage.count = files.size
         end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
+        # TODO: RUBY-882 once TS switches to take filenames, clear this and remove the
         #   @updated variable
 
         # @spec_to_files.clear
@@ -137,6 +138,7 @@ module Contrast
         lib.external_ms = date_to_ms(spec.date)
         lib.internal_ms = lib.external_ms
         lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
+        # Library tags are appended in the ApplicationUpdate delegator
         update_class_counts(lib, digest, spec)
         lib
       end

data/lib/contrast/utils/hash_digest.rb

@@ -32,8 +32,8 @@ module Contrast
           request.parameters.each_key do |name|
             hash.update(name)
           end
-          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
-          hash.update(request.normalized_length_header(cl)) if cl
+          cl = request.headers[CONTENT_LENGTH_HEADER]
+          hash.update_on_content_length(cl) if cl
           hash.finish
         end
 
@@ -69,6 +69,8 @@ module Contrast
           hash.finish
         end
 
+        private
+
         def generate_crypto_hash finding, algorithm
           hash = new
           hash.update(finding.rule_id)
@@ -85,13 +87,6 @@ module Contrast
           hash.finish
         end
 
-        def generate_response_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
-
         def generate_trigger_hash finding
           hash = new
           hash.update(finding.rule_id)
@@ -126,6 +121,15 @@ module Contrast
         end
       end
 
+      CHARS = %w[a b c d e f g].cs__freeze
+      # This method converts and integer value for length into a string value
+      # that we can hash on, based on the logarithmic value of the length, and
+      # updates the current hash with that value.
+      # @param chr [Numeric] the length to translate
+      def update_on_content_length chr
+        update(CHARS[Math.log10(chr.to_s.length).to_i] || CHARS[-1])
+      end
+
       def initialize
         @crc32 = 0
       end
@@ -136,10 +140,6 @@ module Contrast
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
-      def reset
-        @crc32 = 0
-      end
-
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil
       include Contrast::Components::Interface
-      access_component :logging, :heap_dump
+      access_component :heap_dump, :logging
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'
@@ -25,12 +25,13 @@ module Contrast
 
           delay = heap_dump_control[:delay]
           Contrast::Agent::Thread.new do
-            logger.info("HEAP DUMP THREAD INITIALIZED.  WAITING #{ delay } SECONDS TO BEGIN.")
+            logger.info("HEAP DUMP THREAD INITIALIZED. WAITING #{ delay } SECONDS TO BEGIN.")
             sleep(delay)
             capture_heap_dump
           end
         rescue StandardError => e
           logger.info(LOG_ERROR_DUMPS, e)
+          nil
         end
 
         def log_enabled_warning
@@ -79,21 +80,21 @@ module Contrast
           window = heap_dump_control[:window]
           count  = heap_dump_control[:count]
           clean  = heap_dump_control[:clean]
-          logger.info(nil, 'HEAP DUMP MAIN LOOP')
+          logger.info('HEAP DUMP MAIN LOOP')
           ObjectSpace.trace_object_allocations_start
           count.times do |i|
-            logger.info(nil, "STARTING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+            logger.info('STARTING HEAP DUMP PASS', current_pass: i + 1, max: count)
             output = "#{ Time.now.to_f }-heap.dump"
             output = File.join(dir, output)
             begin
-              logger.info(nil, "OPENING FILE #{ dir }/#{ output } FOR HEAP DUMP")
+              logger.info('OPENING HEADUMP FILE', dir: dir, file: output)
               file = File.new(output, FILE_WRITE_FLAGS)
               if clean
-                logger.info(nil, 'PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
+                logger.info('PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
                 GC.start
               end
               ObjectSpace.dump_all(output: file)
-              logger.info(nil, "FINISHING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+              logger.info('FINISHING HEAP DUMP PASS', current_pass: i + 1, max: count)
             ensure
               file.close
             end
@@ -101,10 +102,10 @@ module Contrast
           end
         ensure
           ObjectSpace.trace_object_allocations_stop
-          logger.info(nil, '*****************************************************')
-          logger.info(nil, '********        HEAP DUMP HAS CONCLUDED      ********')
-          logger.info(nil, '***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
-          logger.info(nil, '*****************************************************')
+          logger.info('*****************************************************')
+          logger.info('********        HEAP DUMP HAS CONCLUDED      ********')
+          logger.info('***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
+          logger.info('*****************************************************')
           exit # We weren't kidding!
         end
       end

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      access_component :analysis, :app_context, :logging
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -44,29 +44,13 @@ module Contrast
         activity = Contrast::Api::Dtm::Activity.new
         activity.findings << finding
 
-        # If assess is enabled, we can just send the activity
-        if ASSESS.enabled?
-          build_tags(activity)
-          CONTRAST_SERVICE.queue_message activity
-        # Otherwise, if the Agent isn't ready, we have to queue the messages
-        # until we know the starting state.
-        else
-          Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
-        end
+        Contrast::Agent.messaging_queue.send_event_eventually(activity)
       rescue StandardError => e
-        logger.error(e, "Unable to build a finding for #{ rule_id }")
+        logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private
 
-      # This seems silly to pull out, but we can ONLY call this in the case
-      # where we have a configuration. Doing otherwise results in a bad error
-      # case where we try to do other things, like logging, which behave
-      # strangely without a config
-      def build_tags activity
-        activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-      end
-
       def file_snippet file_path, call_location
         idx = call_location&.lineno
         if file_path && idx && File.exist?(file_path)

data/lib/contrast/utils/inventory_util.rb

@@ -18,18 +18,17 @@ module Contrast
       AC_TYPE_DB = 'db'
       # TeamServer only accepts certain values for FlowMap Services.
       # DO NOT CHANGE THIS
-      DATABASE = 'Database'
       ADAPTER = 'adapter'
       HOST = 'host'
       PORT = 'port'
-      DATABASE_LOWER = 'database'
+      DATABASE = 'database'
       DEFAULT = 'default'
       LOCALHOST = 'localhost'
 
       def self.inventory_class class_path
         Contrast::Utils::GemfileReader.instance.map_class(class_path)
       rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
+        logger.error('Unable to inventory module', e, path: class_path)
       end
 
       def self.active_record_config
@@ -42,7 +41,6 @@ module Contrast
         arr = build_from_db_config(hash_or_str)
         return unless arr&.any?
 
-        activity_or_update.technologies[DATABASE] = true
         arr.each do |a|
           next unless a
 
@@ -51,12 +49,9 @@ module Contrast
           else
             activity_or_update.components << a
           end
-          next if a.vendor.empty?
-
-          activity_or_update.technologies[a.vendor] = true
         end
       rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
+        logger.error('Unable to append db config', e)
         nil
       end
 
@@ -76,7 +71,7 @@ module Contrast
         ac.remote_host = host_from_hash(hash)
         ac.remote_port = port_from_hash(hash)
         ac.type = AC_TYPE_DB
-        ac.url = hash[:database] || hash[DATABASE_LOWER] || DEFAULT
+        ac.url = hash[:database] || hash[DATABASE] || DEFAULT
         [ac]
       end
 

data/lib/contrast/utils/io_util.rb

@@ -11,16 +11,6 @@ module Contrast
 
       access_component :logging
 
-      # StringIO is a valid path because it logs directly to a string buffer
-      def self.write_permission? path
-        return false if path.nil?
-        return true if path.is_a?(StringIO)
-        return File.writable?(path) if File.exist?(path)
-
-        dir_name = File.dirname(File.absolute_path(path))
-        File.writable?(dir_name)
-      end
-
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
       # all others.
@@ -30,7 +20,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug(e, "Encountered an issue inspecting instance of #{ potential_io } - continuing without rewind")
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -7,17 +7,19 @@ module Contrast
     # the application are running
     module JobServersRunning
       include Contrast::Components::Interface
-      access_component :logging
+      access_component :app_context, :logging
 
       class << self
         def job_servers_running?
           sidekiq_running? || rake_running?
         end
 
+        private
+
         def sidekiq_running?
           return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
 
-          logger.debug(nil, 'Detected the spawn of a Sidekiq process')
+          logger.trace('Detected the spawn of a Sidekiq process')
           true
         end
 
@@ -26,11 +28,11 @@ module Contrast
               Rake.cs__respond_to?(:application) &&
               Rake.application.cs__respond_to?(:top_level_tasks)
 
-          disabled_rake_tasks = Contrast::Agent::FeatureState.instance.disabled_agent_rake_tasks
+          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
           has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
           return false unless has_disabled_task
 
-          logger.debug(nil, 'Detected startup within Rake task')
+          logger.trace('Detected startup within Rake task')
           true
         end
       end