contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/utils/comment_range.rb

@@ -1,19 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Stores the range of a comment
-    class CommentRange
-      COMMENT_START = /<!--/.cs__freeze
-      COMMENT_END = '-->'
-
-      attr_reader :open, :close
-
-      def initialize open_idx, close_idx
-        @open = open_idx
-        @close = close_idx
-      end
-    end
-  end
-end

data/lib/contrast/utils/data_store_util.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility class used to determine information about the current data store
-    # on which a query was executed or to which the application is connected.
-    module DataStoreUtil
-      def self.report_data_store data_store
-        return unless data_store
-
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context&.activity
-
-        context.activity.technologies[data_store] = true
-        context.activity.query_count += 1
-        return unless context.activity.query_count == 1
-
-        Contrast::Utils::InventoryUtil.append_db_config(context.activity)
-      end
-    end
-  end
-end

data/lib/contrast/utils/environment_util.rb

@@ -1,81 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'socket'
-
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-
-module Contrast
-  module Utils
-    # Gather information about the application and server environment
-    # that the agent is running in.
-    class EnvironmentUtil
-      CS_VERSION = 'VERSION'
-
-      # Possible names of constants that would hold version info
-      # TODO - RUBY-770
-      VERSION_CONSTANT_CANDIDATES = %w[
-        VERSION
-        ::VERSION
-        Version::VERSION
-        ::Version::VERSION
-        ::Application::VERSION
-      ].cs__freeze
-
-      class << self
-        ######### These are helpers ####################
-
-        def present? str
-          !str.nil? && !str.to_s.empty?
-        end
-
-        ######### Actually env/framework dependent ####################
-
-        # See CONTRAST-16380 for more details
-        # TODO RUBY-770
-        def determine_application_version
-          @_determine_application_version ||= begin
-            candidates = VERSION_CONSTANT_CANDIDATES.map do |name|
-              # If there's a constant named 'name' (VERSION, etc.), get its value.
-
-              name.split('::').inject(Object) do |mod, class_name|
-                mod.cs__const_get(class_name)
-              end
-            rescue LoadError, StandardError
-              nil
-            end
-            candidates.compact!
-            candidate = candidates.first || ENV[CS_VERSION]
-
-            case candidate
-            when Hash
-              candidate.values.join(Contrast::Utils::ObjectShare::PERIOD)
-            when Array
-              candidate.join(Contrast::Utils::ObjectShare::PERIOD)
-            when String
-              candidate
-            when NilClass
-              return nil
-            else
-              candidate.inspect
-            end
-          end
-        end
-
-        # Read libraries from the gemfile and append to the given ApplicationUpdate message
-        # or other class that has a libraries map association
-        # TODO - RUBY-770
-        def add_library_to_app_update app_update_pb, library_tags = ''
-          libraries = Contrast::Utils::GemfileReader.instance.library_pb_list
-          libraries.each do |n|
-            n.tags = library_tags
-            app_update_pb.libraries[n.hash_code] = n
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/performs_logging.rb

@@ -1,152 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This utility allows us wrap our calls to logging, allowing runtime
-    # determination as to whether or not an event should be logged, based upon
-    # the Logging Configuration as specified in Common Configuration.
-    module PerformsLogging
-      include Contrast::Components::Interface
-
-      COULDNT_INIT_CONFIG = '!!! Contrast could not initialize agent from config, flushing loq queue to TARGET !!!'
-      FLUSHING_LOG_QUEUE  = '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-
-      TARGET = STDOUT
-
-      # idiom for propagating class methods
-      def self.included base
-        base.send :include, InstanceMethods
-        base.extend ClassMethods
-      end
-
-      # Grouping to allow for these methods to be included into another Module
-      # on include of the PerformsLogging Module. They'll function as instance
-      # methods in that Module.
-      module InstanceMethods #:nodoc:
-        @_log_mutex = Mutex.new
-        @_log_queue = []
-
-        protected
-
-        def init_log_queueing
-          # Queue log messages & defer logging until logger gets initialized.
-          # (Logger depends on config, so logging config errors implies
-          # circular dependencies.)
-          at_exit do
-            # Ideally we flush the queue when we detect agent init is impossible,
-            # if worse comes to worse we do it here.
-            if @_log_queue
-              lq = @_log_queue
-              if lq&.any?
-                TARGET.puts '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-                while (message = lq.pop)
-                  TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-                end
-              end
-            end
-          end
-        end
-
-        def abort_log_queues
-          TARGET.puts COULDNT_INIT_CONFIG
-          if @_log_queue
-            TARGET.puts FLUSHING_LOG_QUEUE
-            while (message = @_log_queue.pop)
-              TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-            end
-          end
-          @_log_queue = nil
-          @_log_mutex = nil
-        end
-
-        def flush_log_queues
-          return unless @_log_queue
-
-          # Monkeypatch this class so that the next call to #instance flushes the log queue.
-          # (Flushing the log queue within #initialize
-          # causes a deadlock, as singleton classes' #initialize
-          # gets wrapped within a mutex, and our logger will
-          # try to reference the singleton instance.)
-          self.class.class_eval do
-            class << self
-              alias_method :__instance_original, :instance
-              def instance
-                @_log_mutex.synchronize do
-                  # Restore old #instance method.
-                  class_eval do
-                    class << self
-                      def instance
-                        __instance_original
-                      end
-                    end
-                  end
-                  # Flush log queue.
-                  if @_log_queue
-                    while (message = @_log_queue.pop)
-                      log_with_level(*message, skip_queue: true)
-                    end
-                  end
-                  @_log_queue = nil
-                end
-                @_log_mutex = nil
-                __instance_original
-              end
-            end
-          end
-        end
-      end
-
-      module ClassMethods #:nodoc:
-        def log_error msg, exception = nil
-          log_with_level exception, msg, :error
-        end
-
-        def log_warn msg, exception = nil
-          log_with_level exception, msg, :warn
-        end
-
-        def log_info msg, exception = nil
-          log_with_level exception, msg, :info
-        end
-
-        def log_debug msg, exception = nil
-          log_with_level exception, msg, :debug
-        end
-
-        def debug_with_time msg
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        def log_with_level exception, msg, level, skip_queue: false
-          # Log messages are queued until the logger is initialized.
-          # If agent init fails, flush the log to TARGET.
-          if (lq = @_log_queue) && !skip_queue
-            lq.push [exception, msg, level]
-            return nil
-          end
-
-          if exception&.respond_to?(:message)
-            tmp = msg.nil? ? exception.message.to_s : "#{ exception.class.name }: #{ msg }: #{ exception.message }"
-            logger.send(level, tmp)
-
-            exception.backtrace.first(10).each { |line| logger.debug(line) } if logger.debug? && exception.cs__respond_to?(:backtrace) && exception.backtrace
-          elsif msg.to_s != Contrast::Utils::ObjectShare::EMPTY_STRING
-            logger.send(level, msg.to_s)
-          end
-
-          nil # ensure no return value
-        rescue StandardError
-          nil # NOOP
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/rack_assess_session_cookie.rb

@@ -1,104 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze non-rails session storage configuration for assess vulnerabilities
-    module RackAssessSessionCookie
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_NAME = 'rails-http-only-disabled'
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_cookie_initialization options
-          return if PROTECT.enabled?
-
-          apply_session_timeout(options)
-          apply_httponly(options)
-          apply_secure_session(options)
-        end
-
-        def vulnerable_setting?(setting_key,
-                                safe_settings_value,
-                                options, safe_default: true,
-                                comparison_type: nil)
-          # In most cases, Rack is pretty nice and the default value is safe
-          return !safe_default unless options&.key?(setting_key)
-
-          value = options[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_secure_session options
-          return unless vulnerable_setting?(
-              :secure,
-              true,
-              options,
-              safe_default: false)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SECURE_RULE_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to secure session', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_session_timeout options
-          return unless vulnerable_setting?(:expire_after,
-                                            SAFE_SESSION_TIMEOUT,
-                                            options,
-                                            safe_default: false,
-                                            comparison_type: :greater_than)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SESSION_TIMEOUT_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly options
-          return unless vulnerable_setting?(:httponly, true, options)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__HTTPONLY_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to httponly', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/rails_assess_configuration.rb

@@ -1,95 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze rails session storage configuration for assess vulnerabilities
-    module RailsAssessConfiguration
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
-
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_session_store *args
-          return if PROTECT.enabled?
-
-          apply_httponly_disabled(*args)
-          apply_secure_cookie_disabled(*args)
-          apply_session_timeout(*args)
-        end
-
-        def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
-          # In most cases, Rails is pretty nice and the default value is safe
-          return !safe_default unless original_args && original_args.length > 1
-
-          # If the user overrode some args, but not ours, fall back on the default
-          rails_session_settings = original_args[1]
-          return !safe_default unless rails_session_settings&.key?(setting_key)
-
-          value = rails_session_settings[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_session_timeout *args
-          return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
-          return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_secure_cookie_disabled *args
-          return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
-          return unless vulnerable_setting?(:secure, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to disable secure cookies', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly_disabled *args
-          return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
-          return unless vulnerable_setting?(:httponly, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.log_error('Unable to track call to disable httponly in session cookie', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end