contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/tasks/config.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'yaml'
+
+module Contrast
+  # A Rake task to generate a contrast_security.yaml file with some basic settings
+  module Config
+    extend Rake::DSL
+    include Contrast::Components::Interface
+    DEFAULT_CONFIG = {
+        'api' => {
+            'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',
+            'api_key' => 'Enter your Contrast api key',
+            'service_key' => 'Enter your Contrast service key',
+            'user_name' => 'Enter your Contrast user name'
+        },
+        'agent' => {
+            'service' => {
+                'logger' => {
+                    'path' => 'contrast_service.log',
+                    'level' => 'ERROR' # DEBUG | INFO | WARN | ERROR
+                },
+                'socket' => '/tmp/contrast_service.sock'
+            },
+            'logger' => {
+                'level' => 'ERROR',
+                'path' => 'contrast_agent.log'
+            }
+        }
+    }.cs__freeze
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Create a contrast_security.yaml in the applications root directory'
+        task :create do
+          execution_directory = Dir.pwd
+          target_path = File.join(execution_directory, 'contrast_security.yaml')
+          if File.exist?(target_path)
+            puts 'WARNING: contrast_security.yaml already exists'
+          else
+            File.open(target_path, 'w') do |f|
+              f.write(YAML.dump(DEFAULT_CONFIG))
+            end
+
+            puts "Created contrast_security.yaml at #{ target_path }"
+            puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
+            puts 'Visit our documentation site for more details: https://docs.contrastsecurity.com/installation-rubyconfig.html'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/tasks/service.rb

@@ -43,8 +43,6 @@ module Contrast
         task :start do
           if Contrast::Utils::OS.running?
             puts 'Contrast Service already running. No need to start'
-          elsif !CONTRAST_SERVICE.enabled?
-            puts 'Contrast Service disabled by configuration. Not starting.'
           else
             start_service
           end
@@ -58,10 +56,8 @@ module Contrast
         task :status do
           if Contrast::Utils::OS.running?
             puts 'online'
-          elsif CONTRAST_SERVICE.enabled?
-            puts 'offline'
           else
-            puts 'disabled'
+            puts 'offline'
           end
         end
       end

data/lib/contrast/utils/class_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast

data/lib/contrast/utils/gemfile_reader.rb

@@ -92,11 +92,11 @@ module Contrast
           usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
           usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
           activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
+          # TODO: RUBY-882 once TS switches to take filenames, remove the count setter and
           #   send the class names in usage.class_names
           usage.count = files.size
         end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
+        # TODO: RUBY-882 once TS switches to take filenames, clear this and remove the
         #   @updated variable
 
         # @spec_to_files.clear

data/lib/contrast/utils/hash_digest.rb

@@ -69,6 +69,8 @@ module Contrast
           hash.finish
         end
 
+        private
+
         def generate_crypto_hash finding, algorithm
           hash = new
           hash.update(finding.rule_id)
@@ -85,13 +87,6 @@ module Contrast
           hash.finish
         end
 
-        def generate_response_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
-
         def generate_trigger_hash finding
           hash = new
           hash.update(finding.rule_id)

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      access_component :analysis, :app_context, :logging
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -45,9 +45,9 @@ module Contrast
         activity.findings << finding
 
         # If assess is enabled, we can just send the activity
-        if ASSESS.enabled?
+        if APP_CONTEXT.ready?
           build_tags(activity)
-          CONTRAST_SERVICE.queue_message activity
+          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
         # Otherwise, if the Agent isn't ready, we have to queue the messages
         # until we know the starting state.
         else

data/lib/contrast/utils/job_servers_running.rb

@@ -7,13 +7,15 @@ module Contrast
     # the application are running
     module JobServersRunning
       include Contrast::Components::Interface
-      access_component :logging
+      access_component :app_context, :logging
 
       class << self
         def job_servers_running?
           sidekiq_running? || rake_running?
         end
 
+        private
+
         def sidekiq_running?
           return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
 
@@ -26,7 +28,7 @@ module Contrast
               Rake.cs__respond_to?(:application) &&
               Rake.application.cs__respond_to?(:top_level_tasks)
 
-          disabled_rake_tasks = Contrast::Agent::FeatureState.instance.disabled_agent_rake_tasks
+          disabled_rake_tasks = APP_CONTEXT.disabled_agent_rake_tasks
           has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
           return false unless has_disabled_task
 

data/lib/contrast/utils/object_share.rb

@@ -9,7 +9,6 @@ module Contrast
     # duplication.
     class ObjectShare
       # Strings
-      AND =           '&'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''

data/lib/contrast/utils/service_response_util.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/logger'
+cs__scoped_require 'contrast/logger/log'
+cs__scoped_require 'contrast/agent/reaction_processor'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/assess/sampling_util'
 
@@ -11,13 +12,16 @@ module Contrast
     # processes Server and Application settings and updates the Settings component.
     module ServiceResponseUtil
       include Contrast::Components::Interface
-      access_component :analysis, :contrast_service, :logging, :settings
+      access_component :agent, :analysis, :logging, :settings
 
       class << self
-        # TODO: RUBY-119
+        # Return true if the agent has processed a response from the service
+        def update_received?
+          @_last_update.nil?
+        end
+
         def process_response response
-          fs = Contrast::Agent::FeatureState.instance
-          fs.last_update = response&.sent_ms
+          @_last_update = response&.sent_ms
 
           server_features = process_server_response(response)
           app_settings = process_application_response(response)
@@ -25,17 +29,13 @@ module Contrast
           # ReactionProcessor is a design pattern from TeamServer.
           # Right now, there's one potential reaction, which is disabling the agent
           Contrast::Agent::ReactionProcessor.process(response&.application_settings)
-          # Determine new accumulator state
-          if (new_accum = response&.accumulator_settings)
-            SETTINGS.accumulator_settings.replace(new_accum)
-          end
 
-          Contrast::Agent::Logger.instance.update(server_features&.log_file, server_features&.log_level)
+          Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
           logger.trace(
               'Agent settings updated in response to Service',
-              protect_on: fs.protect_enabled?,
-              assess_on: fs.assess_enabled?)
+              protect_on: PROTECT.enabled?,
+              assess_on: ASSESS.enabled?)
         end
 
         private
@@ -68,10 +68,12 @@ module Contrast
         # I don't think it should go into contrast_service because that only handles connection specific data
         def update_features server_features, app_settings
           return unless !!(server_features || app_settings)
+          return unless AGENT.enabled?
 
           logger.trace_with_time('Rebuilding rule modes') do
             SETTINGS.build_protect_rules if PROTECT.enabled?
             SETTINGS.build_assess_rules  if ASSESS.enabled?
+            AGENT.reset_ruleset
 
             logger.info('Current rule settings:')
             PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }

data/lib/contrast/utils/service_sender_util.rb

@@ -13,11 +13,9 @@ module Contrast
     # to SpeedRacer.
     module ServiceSenderUtil
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      access_component :analysis, :app_context, :logging, :settings
 
       class << self
-        attr_reader :assess_messages, :ready_messages_queue
-
         # Push the given DTM into a queue to be sent to the Service.
         #
         # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
@@ -25,30 +23,42 @@ module Contrast
         def push_to_ready_queue event
           return unless event
 
-          # Since a message may try to be pushed before sending_thread starts up, we need to initialize
-          # the queue on first message sent
-          @ready_messages_queue ||= Queue.new
+          prep_queue
           ready_messages_queue.push event
           logger.debug('Enqueued event',
                        event_id: event.__id__,
-                       event_type: event.cs__class.name)
+                       event_type: event.cs__class.name,
+                       queue: ready_messages_queue.__id__,
+                       length: ready_messages_queue.length)
+        end
+
+        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
+        # to receive the response object back from SpeedRacer. An invoking method that needs
+        # to process the response object with custom logic should use this method.
+        #
+        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
+        #   field of Contrast::Api::Dtm::Message
+        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
+        def send_event_immediately event
+          client.send_to_speedracer(event) if event
         end
 
         def sending_thread
-          # in case we got here before a message attempted to be sent, let's make sure these are initialized
-          @ready_messages_queue ||= Queue.new
-          @assess_messages ||= []
+          return @_sender_thread if @_sender_thread
 
+          # in case we got here before a message attempted to be sent, let's make sure these are initialized
           @_sender_thread ||= Contrast::Agent::Thread.new do
             loop do
-              check_assess_queue if assess_messages # don't bother checking if assess queue is already cleared
+              check_assess_queue
               # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
               event = ready_messages_queue.pop
               begin
                 logger.debug('Dequeued event',
                              event_id: event.__id__,
-                             event_type: event.cs__class.name)
-                response = Contrast::Agent::FeatureState.instance.client.send_to_speedracer event
+                             event_type: event.cs__class.name,
+                             queue: ready_messages_queue.__id__,
+                             length: ready_messages_queue.length)
+                response = client.send_to_speedracer(event)
                 Contrast::Utils::ServiceResponseUtil.process_response(response) if response
               rescue StandardError => e
                 logger.error('Could not send message to service from service sender thread.', e)
@@ -64,17 +74,64 @@ module Contrast
         end
 
         def add_to_assess_messages msg
-          # This list holds messages containing assess findings. We currently
-          # do not know if the agent is running in assess, so until we do then
-          # we must keep the messages stored here.
-          @assess_messages ||= []
-          assess_messages << msg
+          assess_messages! << msg
+        end
+
+        # Return true if the agent has connected with the service
+        def connection_established?
+          client.connection_established?
         end
 
         private
 
+        # TODO: RUBY-920
+        # If we've been forked, then we need to make sure the sender is set and
+        # alive. This is a temporary workaround to address issues in Passenger
+        # around forking and will be addressed next sprint.
+        def prep_queue
+          return if @_sender_thread&.alive?
+
+          @_sender_thread = nil
+          start
+        end
+
+        def ready_messages_queue
+          @_ready_messages_queue ||= begin
+                                       tmp = Queue.new
+                                       logger.debug('Creating new ready_messages_queue.',
+                                                    queue: tmp.__id__,
+                                                    length: tmp.length)
+                                       tmp
+                                     end
+        end
+
+        def assess_messages!
+          unless @_assess_messages
+            logger.debug('Creating new assess messages queue by force.')
+            @_assess_messages = nil
+          end
+          assess_messages
+        end
+
+        # This list holds messages containing assess findings. We may not
+        # know if the agent is running in assess, so until we do then we
+        # must keep the messages stored here. Once we do know, we'll set this
+        # to `false` and rely on the standard ready_messages_queue
+        def assess_messages
+          if @_assess_messages.nil?
+            logger.debug('Creating new assess messages queue.')
+            @_assess_messages = []
+          end
+          @_assess_messages
+        end
+
+        def client
+          @_client ||= Contrast::Agent::SocketClient.new
+        end
+
         def check_assess_queue
-          return unless AGENT.ready?
+          return unless assess_messages
+          return unless APP_CONTEXT.ready?
 
           if ASSESS.enabled?
             assess_messages.each do |msg|
@@ -82,7 +139,7 @@ module Contrast
               ready_messages_queue.push msg # this message is ready to be sent to SR
             end
           end
-          @assess_messages = nil # clear out queue, we no longer need it
+          @_assess_messages = false # clear out queue, we no longer need it
         end
 
         # When we queued up findings, we didn't have access to a configuration
@@ -101,7 +158,7 @@ module Contrast
           end
 
           msg.findings.each do |finding|
-            finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+            finding.session_id = SETTINGS.session_id
           end
         end
       end

data/resources/assess/policy.json

@@ -975,49 +975,8 @@
       "method_visibility": "private",
       "method_name": "sprintf",
       "action": "CUSTOM",
-      "patch_class": "KernelPropagator",
+      "patch_class": "Contrast::Extension::Assess::KernelPropagator",
       "patch_method": "sprintf_tagger"
-    }, {
-      "class_name":"SQLite3::Statement",
-      "instance_method": true,
-      "method_visibility": "private",
-      "method_name":"initialize",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger",
-      "source": "P1"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"sync_exec",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"sync_exec_params",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"async_exec",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"async_exec_params",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
     }, {
       "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
       "instance_method": true,
@@ -1238,9 +1197,9 @@
           "method_name": "evaluate",
           "instance_method": true,
           "method_visibility": "public",
-          "source":"O",
-          "trigger_class": "TiltTemplateTrigger",
-          "trigger_method": "render_trigger_check"
+          "source": "O",
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::ReflectedXss",
+          "trigger_method": "xss_tilt_trigger"
         },
         {
           "class_name":"String",
@@ -1695,16 +1654,16 @@
           "method_visibility": "private",
           "method_name": "initialize",
           "source": "P1",
-          "trigger_class": "XPathLibraryTrigger",
-          "trigger_method": "xpath_trigger_check"
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::Xpath",
+          "trigger_method": "xpath_expression_trigger"
         }, {
           "class_name": "Oga::XML::CharacterNode",
           "instance_method": true,
-          "method_visibility": "public",
+          "method_visibility": "private",
           "method_name": "initialize",
           "source": "P0",
-          "trigger_class": "XPathLibraryTrigger",
-          "trigger_method": "xpath_trigger_check"
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::Xpath",
+          "trigger_method": "xpath_oga_trigger"
         }, {
           "class_name": "XPather",
           "instance_method": true,