contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/utils/object_share.rb

@@ -9,9 +9,6 @@ module Contrast
     # duplication.
     class ObjectShare
       # Strings
-      AND =           '&'
-      OR =            '||'
-      PIPE =          '|'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
@@ -27,47 +24,27 @@ module Contrast
       NEW_LINE =      "\n"
       NIL_STRING =    'nil'
       PERIOD =        '.'
-      PLUS_SIGN =     '+'
-      POUND_SIGN = HASH_CHAR = '#'
+      POUND_SIGN =    '#'
       QUESTION_MARK = '?'
       RETURN =        "\r"
       SEMICOLON =     ';'
       SINGLE_QUOTE =  '\''
       SLASH =         '/'
-      SPACE =         ' '
       UNDERSCORE =    '_'
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'
       LEFT_ANGLE =    '<'
-      RIGHT_ANGLE =   '>'
-      LEFT_BRACKET =   '['
-      RIGHT_BRACKET =  ']'
-      LEFT_PAREN =     '('
-      RIGHT_PAREN =    ')'
       COLON_SLASH_SLASH = '://'
-      TICK =           '`'
-      BACK_TICK =      '`'
-      LEFT_CURLY =     '{'
-      RIGHT_CURLY =    '}'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
-      PERCENT =        '%'
-      LETTER_Q =       'Q'
-      OR_STRING =      'or'
 
-      DOUBLE_QUOTE_ESCAPED = '&quot;'
-
-      READ_FLAG =     'r'
       WRITE_FLAG =    'w'
-      READ_WRITE_FLAG = 'rw'
 
       PARENT_PATH =   '..'
 
       RUBY = 'Ruby'
       CACHE = 'cache'
-      GEM_SUFFIX = '.gem'
 
-      CONTRAST_METHOD_START = 'cs__'
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
       CONTRAST_MODULE_START = 'Contrast::'
       ANONYMOUS_CLASS_MARKER = '#<'
@@ -75,13 +52,11 @@ module Contrast
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze
-      EMPTY_TRIPLE = [EMPTY_STRING, EMPTY_STRING, EMPTY_STRING].freeze
 
       # RegExps
       DIGIT_REGEXP =       /[[:digit:]]/.freeze
       WHITE_SPACE_REGEXP = /\s/.freeze
       NOT_WHITE_SPACE_REGEXP = /[^\s]/.freeze
-      WINDOWS_REGEXP = /cygwin|mswin|mingw|bccwin|wince|emx/.freeze
 
       # Messages
       OVERRIDE_MESSAGE = 'A security filter prevented original response from being returned.'
@@ -93,10 +68,7 @@ module Contrast
       CLASS = 'Class'
       MODULE = 'Module'
 
-      BRACKET_INTERPOLATION_START = '#{'
-
       OBJECT_KEY = 'O'
-      PARAMETER_KEY = 'P'
       RETURN_KEY = 'R'
       UNKNOWN = 'unknown'
 

data/lib/contrast/utils/os.rb

@@ -1,47 +1,35 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     # Simple utility used to make OS calls and determine state. For that state
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
-      class << self
-        def windows?
-          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil? if @_windows.nil?
-          @_windows
-        end
-
-        def mac?
-          @_mac ||= !(/darwin/ =~ RUBY_PLATFORM).nil? if @_mac.nil?
-          @_mac
-        end
-
-        def unix?
-          @unix ||= !windows? if @_unix.nil?
-          @unix
-        end
-
-        def linux?
-          @_linux ||= unix? && !OS.mac? if @_linux.nil?
-          @_linux
-        end
+      include Contrast::Components::Interface
+      access_component :scope
 
+      class << self
         def running?
-          process = if Contrast::Utils::OS.windows?
-                      `tasklist /fi "imagename eq contrast-service.exe"`
-                    else
-                      `ps aux | grep contrast-servic[e]`
-                    end
-          process != ''
+          result = false
+          with_contrast_scope do
+            process = `ps aux | grep contrast-servic[e]`
+            processes = process.split("\n")
+            result = !processes.empty? && processes.any? { |process_descriptor| !process_descriptor.include?('grep') }
+          end
+          result
         end
 
         # check if service was killed and is a zombie process
         # returns an array of zombie process PIDs as strings; empty array if there are none
         def zombie_pids
-          zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
-          zombie_pid_list.split("\n")
+          with_contrast_scope do
+            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
+            zombie_pid_list.split("\n")
+          end
         end
       end
     end

data/lib/contrast/utils/stack_trace_utils.rb

@@ -8,202 +8,105 @@ module Contrast
   module Utils
     # Utilities for converting ruby stack trace into DTMs
     class StackTraceUtils
-      CONTRAST_MARKER = 'contrast/extensions/ruby_core'
-      MONKEYPATCH_MARKER = 'cs__'
-
-      # TODO: RUBY-532
-      CLASSNAME_CACHE = Contrast::Utils::Cache.new
-
       # need lib here to separate from specs
-      AGENT_CLASS_MARKERS = %w[
-        /lib/contrast/
-      ].cs__freeze
-
-      def self.custom_code_context?
-        stack = Kernel.caller(0, 15)
-        i = 0
-        while i < stack.length
-          stack_element = stack[i]
-          if stack_element.include?('contrast')
-            # Noop
-          elsif stack_element.include?('gems')
-            return false
-          else
-            return true
+      AGENT_CLASS_MARKER = '/lib/contrast/'
+
+      class << self
+        # Determine if this method is being invoked by application code or not
+        # based on the immediate caller of the code after Contrast.
+        #
+        # @return [Boolean] true if this code is called with application
+        #   (non-gem) code in the caller
+        def custom_code_context?
+          root_dir = Contrast::Agent.framework_manager.app_root
+
+          stack = Kernel.caller(0, 15)
+          i = 0
+          while i < stack.length
+            stack_element = stack[i]
+            i += 1
+            next if stack_element.include?('/contrast/')
+
+            return stack_element.start_with?(root_dir)
           end
-          i += 1
         end
-      end
-
-      def self.build(
-          skip: 0,
-          depth: 10,
-          ignore: false,
-          ignore_strings: AGENT_CLASS_MARKERS,
-          class_lookup: false,
-          rasp_element: true)
-
-        stack = caller(skip.to_i, depth.to_i)
-        return [] unless stack
-
-        stack = reject_caller_entries(stack, ignore_strings) if ignore
-        stack.map! do |entry|
-          element = rasp_or_assess(rasp_element)
-          element = fill_element(element, entry, class_lookup)
-          element
-        end
-        stack.compact!
-        stack
-      end
 
-      def self.reject_caller_entries stack, ignore_strings
-        return stack unless ignore_strings&.any?
-
-        stack.reject do |entry|
-          ignore_strings.any? { |marker| entry.include?(marker) } ||
-              entry.include?(MONKEYPATCH_MARKER)
+        # Call and translate a caller_locations array to an array of
+        # StackTraceElement for TeamServer to display, excluding any Contrast
+        # code found.
+        #
+        # @return [Array<Contrast::Api::Dtm::StackTraceElement]
+        def build_protect_stack_array
+          stack = caller(2, 20)
+          return [] unless stack
+
+          stack = reject_caller_entries(stack)
+          i = 0
+          stack.map! do |entry|
+            element = Contrast::Api::Dtm::StackTraceElement.new
+            element = fill_protect_element(element, entry, i)
+            i += 1
+            element
+          end
+          stack.compact!
+          stack
         end
-      end
 
-      def self.rasp_or_assess rasp_element
-        if rasp_element
-          Contrast::Api::Dtm::StackTraceElement.new
-        else
-          Contrast::Api::Dtm::TraceStack.new
+        # Translate a caller array to an array of TraceStacks for TeamServer to
+        # display, excluding any Contrast code found.
+        #
+        # @param stack [Array<String>] the output of Kernel.caller
+        # @return [Array<Contrast::Api::Dtm::TraceStack]
+        def build_assess_stack_array stack
+          converted = []
+          return converted unless stack
+
+          i = 0
+          while i < stack.length
+            caller_location = stack[i]
+            i += 1
+            next if caller_location.include?(AGENT_CLASS_MARKER)
+
+            # To play nice with the way that TeamServer is rendering these
+            # values, we only populate the file_name field with exactly what we
+            # want them to display
+            element = Contrast::Api::Dtm::TraceStack.new
+            element.file_name = caller_location
+            converted << element
+          end
+          converted
         end
-      end
 
-      def self.to_dtm_stack stack_locations: nil, rasp_element: true
-        return [] unless stack_locations
+        private
 
-        stack_locations = reject_locations(stack_locations)
-        stack_locations.map! do |caller_location|
-          element = rasp_or_assess(rasp_element)
-          element = fill_loc_element(element, caller_location)
-          element
-        end
-        stack_locations.compact!
-        stack_locations
-      end
-
-      def self.reject_locations stack_locations
-        stack_locations.reject do |entry|
-          class_path = entry.path
-          method = entry.label
-          AGENT_CLASS_MARKERS.any? { |marker| class_path.include?(marker) } ||
-              method.include?(MONKEYPATCH_MARKER)
+        def reject_caller_entries stack
+          stack.reject do |entry|
+            entry = entry.to_s
+            entry.include?(AGENT_CLASS_MARKER)
+          end
         end
-      end
 
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_element element, str, class_lookup
-        return element if str.nil? || str.strip.empty?
-
-        path, line, method = str.split(':')
-        element.line_number = line.to_i
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        declaring_class = best_classname(path, element.file_name) if class_lookup
-        element.declaring_class = Contrast::Utils::StringUtils.force_utf8(declaring_class)
-        method_name = find_method_name(method)
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(method_name)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
-
-      def self.best_classname path, file
-        name = first_class(path)
-        name || look_like_classname(file)
-      end
-
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_loc_element element, caller_location
-        return element unless caller_location
-
-        lineno = caller_location.lineno
-        element.line_number = lineno.to_i
-        path = caller_location.path
-        path = Contrast::Utils::StringUtils.force_utf8(path)
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        element.declaring_class = path
-        label = caller_location.label
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(label)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
+        # In Contrast UI - there are many ways to render the stacktraces. For
+        # Protect, there are two ways we're concerned about, one for the first
+        # element and then all others.
+        # 1 for protect first frame - We need the method specifically for this rendering
+        # 1 for protect Nth frames
+        def fill_protect_element element, caller_location, index
+          return element unless caller_location
+
+          if index.zero?
+            element.method_name = caller_location.split('`')[-1].delete_suffix!('\'')
+            element.file_name = caller_location.split(':')[0]
+          else
+            element.file_name = caller_location
+          end
 
-      def self.filename_from_path path
-        file_idx = path.rindex(Contrast::Utils::ObjectShare::SLASH)
-        if file_idx
-          txt_idx = file_idx + 1
-          path[txt_idx, path.length - txt_idx]
-        else
-          path
+          element
+        rescue StandardError
+          # NOOP
+          nil
         end
       end
-
-      # Bit of a HACK: Given a path to a file, assume that the first line in the
-      # form `class Name` is the class that was loaded. True most of the time.
-      #
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /\s*class\s+([_[:alpha:]][_[:alnum:]]*)/m
-      CLASS_MARKER = ' class '
-      CLASS_END_MARKER = Contrast::Utils::ObjectShare::NEW_LINE
-      def self.first_class path
-        return nil if path.nil? || path.empty?
-
-        name = CLASSNAME_CACHE[path]
-        return name if name
-
-        text = File.read(path)
-        name = parse_string(text, CLASS_MARKER, CLASS_END_MARKER)
-        CLASSNAME_CACHE[path] = name if name
-        name
-      end
-
-      RB_MARKER = '.rb'
-      # Convert a file to look like a classname
-      # If the file ends w/ '.rb', trim that off
-      # If the file doesn't start with a capital letter,
-      # capitalize it
-      def self.look_like_classname file
-        file = file.to_s
-        file[0].capitalize + (file.end_with?(RB_MARKER) ? file.slice(1..-4) : file.slice(1..-1))
-      end
-
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /[`]([^']*)[']/
-      METHOD_MARKER = Contrast::Utils::ObjectShare::TICK
-      METHOD_END_MARKER = Contrast::Utils::ObjectShare::COMMA
-      def self.find_method_name method
-        parse_string(method, METHOD_MARKER, METHOD_END_MARKER)
-      end
-
-      def self.parse_string string, start_marker, end_marker
-        return nil unless string
-
-        start_idx = string.index(start_marker)
-        return nil unless start_idx
-
-        start_idx += start_marker.length # account for marker length
-        end_idx = string.index(end_marker, start_idx)
-        end_idx ||= string.length
-        len = end_idx - start_idx
-        string[start_idx, len]
-      end
     end
   end
 end

data/lib/contrast/utils/string_utils.rb

@@ -1,10 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
+      include Contrast::Components::Interface
+      access_component :logging
+
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP-'
 
@@ -17,6 +22,17 @@ module Contrast
         string.nil? ? 0 : string.to_s.length
       end
 
+      def self.present? str
+        !str.nil? && !str.to_s.empty?
+      end
+
+      def self.protobuf_format data, truncate: true
+        data = data&.to_s
+        data = Contrast::Utils::StringUtils.force_utf8(data)
+        data = Contrast::Utils::StringUtils.truncate(data) if truncate
+        data
+      end
+
       # Protobuf has a very strict typing. Nil is not a String and will throw
       # an exception if you try to set it. Use this to be safe.
       # Uses the object share to avoid creating several new strings per request
@@ -31,7 +47,7 @@ module Contrast
         str.to_s[0..255]
       end
 
-      def self.force_utf8 str, logger = nil
+      def self.force_utf8 str
         return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
 
         str = str.to_s
@@ -45,7 +61,7 @@ module Contrast
         # We were unable to switch the String to a UTF-8 format.
         # Return non-nil so as not to throw an exception later when trying
         # to do regexp or other compares on the String
-        logger&.debug "Unable to change '#{ str }' to valid UTF-8: #{ e.message }"
+        logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
         Contrast::Utils::ObjectShare::EMPTY_STRING
       end