contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -0,0 +1,83 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/sinatra/support'
+
+module Contrast
+  module Framework
+    module Sinatra
+      module Patch
+        # Our patch into the Sinatra::Base Class, allowing for the inventory of the
+        # routes called by the application
+        module Base
+          class << self
+            # Use logic copied from Sinatra::Base#process_route to determine which
+            # pattern matches the request being invoked by Sinatra::Base#call!
+            #
+            # @param clazz [Class] the Class that extends Sinatra::Base in
+            #   which this route is defined.
+            # @param settings [Object] the Sinatra::Base @settings object.
+            # @param args [Array<Object>] we rely on the @settings object in
+            #   Sinatra::Base and the env variable passed in as args[0].
+            def map_route clazz, settings, *args
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context
+
+              env = args[0]
+              return unless env
+              return unless settings
+
+              convert_routes(context, clazz, settings, env)
+            rescue StandardError
+              # Being careful here since we're directly patching something
+            end
+
+            def instrument
+              @_instrument ||= begin
+                                ::Sinatra::Base.class_eval do
+                                  alias_method :cs__patched_sinatra_base_call!, :call!
+                                  # publicly available method for Sinatra::Base things -- unfortunately,
+                                  # getting the routes appear to require a lookup every time
+                                  def call! *args
+                                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
+                                    cs__patched_sinatra_base_call!(*args)
+                                  end
+                                end
+                                true
+                              end
+            end
+
+            private
+
+            # Find the route that matches this request. Since we're using
+            # settings, we should resolve in the same precedence as Sinatra
+            def convert_routes context, clazz, settings, env
+              # There isn't a Request object in the Sinatra::Base yet - it's made
+              # during the #call! method, which we're patching - so we need to
+              # access the env
+              method = env[::Rack::REQUEST_METHOD]
+              # get all potential routes for this request type
+              routes = settings.routes[method]
+              return unless routes
+
+              route = env[::Rack::PATH_INFO]
+              route = route.to_s
+
+              # Do some cleanup that matches Sinatra::Base#process_route
+              route = '/' if route.empty? && !settings.empty_path_info?
+              route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
+
+              routes.each do |pattern, _, _| # Mustermann::Sinatra
+                next unless pattern.params(route)
+
+                dtm = Contrast::Framework::Sinatra::Support.send(:route_to_coverage, clazz, method, pattern)
+                context.append_route_coverage(dtm)
+                break
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Sinatra
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Sinatra framework.
+        module Support
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Sinatra::Base',
+                          'contrast/framework/sinatra/patch/base',
+                          method_to_instrument: nil,
+                          instrumenting_module: 'Contrast::Framework::Sinatra::Patch::Base')
+                    ])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/support.rb

@@ -0,0 +1,109 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/sinatra/application_helper'
+cs__scoped_require 'contrast/framework/sinatra/patch/support'
+
+module Contrast
+  module Framework
+    module Sinatra
+      # Used when Sinatra is present to define framework specific behavior
+      class Support < BaseSupport
+        extend Contrast::Framework::Sinatra::ApplicationHelper
+        extend Contrast::Framework::Sinatra::Patch::Support
+        class << self
+          def detection_class
+            'Sinatra'
+          end
+
+          def version
+            ::Sinatra::VERSION
+          end
+
+          def application_name
+            return unless app_class
+
+            app_class.cs__class.cs__name
+          end
+
+          def application_root
+            return unless app_class
+
+            app_class.root
+          end
+
+          def server_type
+            'sinatra'
+          end
+
+          def scan_views
+            return unless app_class
+
+            scan_view_directories(scannable_view_dirs)
+          end
+
+          # Iterate over every class that extends Sinatra::Base, pull out its routes
+          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+          # Contrast::Api::Dtm::RouteCoverage
+          def collect_routes
+            routes = []
+            controllers = sinatra_controllers
+            controllers.each do |clazz|
+              class_routes = sinatra_class_routes(clazz)
+              next unless class_routes
+
+              class_routes.each_pair do |method, list|
+                # item: [ Mustermann::Sinatra, [], Proc]
+                list.each do |item|
+                  routes << route_to_coverage(clazz, method, item[0])
+                end
+              end
+            end
+            routes
+          end
+
+          # TODO: RUBY-763
+          def current_route _request
+            nil
+          end
+
+          def retrieve_request env
+            ::Sinatra::Request.new(env)
+          end
+
+          private
+
+          # Iterate over every class that extends Sinatra::Base, pull out its routes
+          # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
+          # Contrast::Api::Dtm::RouteCoverage
+          def sinatra_controllers
+            return [] unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            Contrast::Utils::ClassUtil.descendants(::Sinatra::Base)
+          end
+
+          def sinatra_class_routes controller
+            controller.instance_variable_get(:@routes) if controller.instance_variable_defined?(:@routes)
+          rescue StandardError
+            logger.trace('Sinatra controller found with no route instances', module: controller)
+            nil
+          end
+
+          # TODO: RUBY-763
+          # given clazz, method, and Mustermann::Sinatra, build a
+          # Contrast::Api::Dtm::RouteCoverage
+          def route_to_coverage clazz, method, pattern
+            safe_pattern = source_or_string(pattern)
+
+            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
+            route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            route_coverage
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/logger/application.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Logger
+    # # Our decorator for the Ougai logger allowing for the logging of the
+    # application environment, used to provide context during troubleshooting.
+    module Application
+      include Contrast::Components::Interface
+      access_component :config
+
+      ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
+      # Utility method to log some current ruby and rails information from environment
+      def application_environment
+        return unless info?
+
+        info('Process environment information',
+             p_id: Process.pid,
+             pp_id: Process.ppid,
+             agent_version: Contrast::Agent::VERSION)
+        ENV.each do |env_key, env_value|
+          env_key = env_key.to_s
+          next unless ENV_KEYS.include?(env_key) ||
+              (env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) &&
+                  !env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER + 'API'))
+
+          info('Environment settings', key: env_key, value: env_value)
+        end
+      end
+
+      def application_configuration
+        return unless info?
+
+        loggable = CONFIG.raw.send(:load_config)
+        loggable.delete('api')
+        info('Current configuration', configruation: JSON.pretty_generate(loggable))
+      end
+
+      def application_libraries
+        if debug?
+          log_all_libraries
+        elsif info?
+          log_specific_libraries
+        end
+      end
+
+      FRAMEWORKS = %w[rails sinatra grape].cs__freeze
+      WEB_SERVERS = %w[agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn webrick yarn].cs__freeze
+      LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
+      def log_specific_libraries
+        FRAMEWORKS.each(&cs__method(:log_gem_data))
+        WEB_SERVERS.each(&cs__method(:log_gem_data))
+        LIBRARIES.each(&cs__method(:log_gem_data))
+      end
+
+      private
+
+      def log_all_libraries
+        return unless debug?
+
+        Gem.loaded_specs.each_pair do |_name, gem_spec|
+          debug('Gem loaded',
+                gem_name: gem_spec.name,
+                gem_version: gem_spec.version.to_s)
+        end
+      end
+
+      def log_gem_data gem_name
+        gem_spec = Gem.loaded_specs[gem_name]
+        return unless gem_spec
+
+        info('Gem loaded',
+             gem_name: gem_spec.name,
+             gem_version: gem_spec.version.to_s)
+      end
+    end
+  end
+end

data/lib/contrast/{agent/logger.rb → logger/log.rb}

@@ -5,62 +5,16 @@ cs__scoped_require 'logger'
 cs__scoped_require 'ougai'
 cs__scoped_require 'singleton'
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/logger/application'
+cs__scoped_require 'contrast/logger/time'
 
 module Contrast
-  module Ougai
-    # Our decorator for the Ougai logger allowing for timing and with_level
-    # methods.
-    module Logger
-      # Log the message at the given level.
-      #
-      # @param level [String] the name of the method to use. Should be one of
-      #   trace, debug, info, warn, error
-      # @param message [String] the message to log
-      def with_level level, message
-        send(level.to_sym, message)
-      end
-
-      # Log, at the debug level, the action with a message including the time
-      # it took for the wrapped function to complete.
-      #
-      # @param msgs [Array<Object>] the arguments to pass to the logger.
-      #   msgs[0] will be modified to include the elapsed time.
-      # @param block [Block, Proc] the block to execute
-      def debug_with_time *msgs, &block
-        log_with_time(:debug, *msgs, &block)
-      end
-
-      # Log, at the trace level, the action with a message including the time
-      # it took for the wrapped function to complete.
-      #
-      # @param msgs [Array<Object>] the arguments to pass to the logger.
-      #   msgs[0] will be modified to include the elapsed time.
-      # @param block [Block, Proc] the block to execute
-      def trace_with_time *msgs, &block
-        log_with_time(:trace, *msgs, &block)
-      end
-
-      private
-
-      def log_with_time level, *msgs
-        a = Contrast::Utils::Timer.now_ms
-        ret = yield if block_given?
-        z = Contrast::Utils::Timer.now_ms
-        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
-        send(level, *msgs)
-        ret
-      end
-    end
-  end
-end
-
-module Contrast
-  module Agent
+  module Logger
     # This class functions to serve as a wrapper around our logging, as we need
     # to be able to dynamically update level based on updates to TeamServer.
-    class Logger
+    class Log
       include Singleton
       include Contrast::Components::Interface
       access_component :config
@@ -102,8 +56,7 @@ module Contrast
         @previous_level = level_const
 
         @_logger = build(path: path, level_const: level_const)
-
-        logger.debug('Initialized new contrast agent logger')
+        log_update
       rescue StandardError => e
         logger.error('Unable to process update to LoggerManager.', e)
       end
@@ -131,13 +84,18 @@ module Contrast
                  else
                    ::Ougai::Logger.new(path)
                  end
-        logger.extend(Contrast::Ougai::Logger)
+        add_contrast_loggers(logger)
         logger.progname = 'Contrast Agent'
         logger.level = level_const
         logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
         logger
       end
 
+      def add_contrast_loggers logger
+        logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Time)
+      end
+
       def valid_path path
         path = path.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : path
         return path if path == STDOUT_STR
@@ -168,6 +126,17 @@ module Contrast
       rescue StandardError
         DEFAULT_LEVEL
       end
+
+      # Log that the Agent log has changed and include some default information
+      # at the start of the log.
+      def log_update
+        logger.debug('Initialized new contrast agent logger')
+        logger.debug_with_time('middleware: log environment') do
+          logger.application_environment
+          logger.application_configuration
+          logger.application_libraries
+        end
+      end
     end
   end
 end

data/lib/contrast/logger/time.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for timing and with_level
+    # methods.
+    module Time
+      # Log the message at the given level.
+      #
+      # @param level [String] the name of the method to use. Should be one of
+      #   trace, debug, info, warn, error
+      # @param message [String] the message to log
+      def with_level level, message
+        send(level.to_sym, message)
+      end
+
+      # Log, at the debug level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def debug_with_time *msgs, &block
+        log_with_time(:debug, *msgs, &block)
+      end
+
+      # Log, at the trace level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def trace_with_time *msgs, &block
+        log_with_time(:trace, *msgs, &block)
+      end
+
+      private
+
+      def log_with_time level, *msgs
+        a = Contrast::Utils::Timer.now_ms
+        ret = yield if block_given?
+        z = Contrast::Utils::Timer.now_ms
+        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
+        send(level, *msgs)
+        ret
+      end
+    end
+  end
+end