contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/agent/request_context.rb

@@ -14,7 +14,7 @@ module Contrast
     # in a standardized and normalized format which the Agent understands.
     class RequestContext
       include Contrast::Components::Interface
-      access_component :analysis, :contrast_service, :logging, :scope
+      access_component :agent, :analysis, :logging, :scope
 
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
 
@@ -90,10 +90,7 @@ module Contrast
         # For TS routes
         @observed_route.signature  = route.route
         @observed_route.verb       = route.verb
-        @observed_route.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-
-        # TODO: SPEED-273: deprecate when SR handles this. ContrastUI API currently does not allow empty url, so we have to provide a default
-        @observed_route.url        = route.url.empty? ? Contrast::Utils::ObjectShare::SLASH : route.url
+        @observed_route.url        = route.url if route.url
       end
 
       # Collect the results for the given rule with the given action
@@ -111,10 +108,11 @@ module Contrast
       end
 
       def service_extract_request
+        return false unless AGENT.enabled?
         return false unless PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = CONTRAST_SERVICE.send_message(@activity.http_request)
+        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)
@@ -128,8 +126,8 @@ module Contrast
           logger.trace('Analysis from Contrast Service was empty.')
           false
         end
-      rescue Contrast::SecurityException
-        raise
+      rescue Contrast::SecurityException => e
+        raise e
       rescue StandardError => e
         logger.warn('Unable to extract Contrast Service information from request', e)
         false
@@ -139,21 +137,20 @@ module Contrast
       # when the protect state indicates a security exception should be thrown. This method
       # ensures that the attack reports are generated. Normally these should be generated on
       # Speedracer for any attacks detected during prefilter.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def handle_protect_state agent_settings
-        return unless agent_settings
-        return unless agent_settings.protect_state
-
-        @uuid = agent_settings.protect_state.uuid
-        @do_not_track = true unless agent_settings.protect_state.track_request
+        return unless agent_settings&.protect_state
 
-        return unless agent_settings.protect_state.security_exception
+        state = agent_settings.protect_state
+        @uuid = state.uuid
+        @do_not_track = true unless state.track_request
+        return unless state.security_exception
 
         # If Contrast Service has NOT handled the input analysis, handle them here
         build_attack_results(agent_settings)
-
-        msg = agent_settings.protect_state.security_message
-        logger.warn('Contrast Service said to block this request')
-        raise Contrast::SecurityException.new(nil, (msg || 'Blocking suspicious behavior'))
+        logger.debug('Contrast Service said to block this request')
+        raise Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior'))
       end
 
       # append anything we've learned to the request seen message
@@ -184,6 +181,8 @@ module Contrast
 
       # Generate attack results directly from any evaluations on the
       # agent settings object.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def build_attack_results agent_settings
         return unless agent_settings&.input_analysis&.results&.any?
 

data/lib/contrast/agent/request_handler.rb

@@ -8,7 +8,7 @@ module Contrast
     # prefilter and postfilter).
     class RequestHandler
       include Contrast::Components::Interface
-      access_component :agent, :contrast_service, :logging, :scope
+      access_component :agent, :logging, :scope
 
       attr_reader :ruleset, :context
 
@@ -20,7 +20,7 @@ module Contrast
       def send_activity_messages
         Contrast::Utils::GemfileReader.instance.generate_library_usage(context.activity)
         [context.server_activity, context.activity, context.observed_route].each do |message|
-          CONTRAST_SERVICE.send_message message
+          Contrast::Agent.messaging_queue.send_event_eventually(message)
         end
       end
 

data/lib/contrast/agent/response.rb

@@ -43,7 +43,7 @@ module Contrast
       def dtm
         context_response = Contrast::Api::Dtm::HttpResponse.new
         context_response.response_code = response_code.to_i
-        headers.each_pair do |key, value|
+        headers&.each_pair do |key, value|
           k = Contrast::Utils::StringUtils.force_utf8(key)
           v = Contrast::Utils::StringUtils.force_utf8(value)
           context_response.response_headers[k] = v
@@ -75,48 +75,16 @@ module Contrast
         end
       end
 
-      # Header keys upcased and any underscores replaced with dashes
-      # We cannot memoize this, b/c response headers can change during the
-      # request lifecycle.
-      def normalized_headers
-        hash = {}
-        headers.each_pair do |header_name, header_value|
-          hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-        end
-        hash
-      end
-
-      CONTENT_TYPE_HEADER = 'CONTENT-TYPE'.cs__freeze
       def content_type
         return unless rack_response
 
         if @is_array
-          normalized_headers[CONTENT_TYPE_HEADER]
+          headers[Rack::CONTENT_TYPE]
         else
           rack_response.content_type
         end
       end
 
-      def header key
-        return unless rack_response
-
-        if @is_array
-          normalized_headers[Contrast::Utils::StringUtils.normalized_key(key)]
-        else
-          rack_response.get_header(key)
-        end
-      end
-
-      def set_header key, value
-        return unless rack_response
-
-        if @is_array
-          Rack::Utils.set_cookie_header!(rack_response[1], key, value)
-        elsif rack_response.is_a?(Rack::Response)
-          rack_response.set_header(key, value)
-        end
-      end
-
       # The response body can change during the request lifecycle
       # We should not extract it out as a variable here, or we'll miss those
       # changes.
@@ -127,59 +95,10 @@ module Contrast
         extract_body(body_content)
       end
 
-      def update_body body_string
-        return unless rack_response
-
-        successfully_updated_body = true
-        if @is_array
-          if rack_response[2].is_a?(Rack::BodyProxy)
-            successfully_updated_body = update_rack_body_proxy(body_string, true)
-          else
-            rack_response[2] = [body_string]
-          end
-        elsif rack_response.body.is_a?(Rack::BodyProxy)
-          successfully_updated_body = update_rack_body_proxy(body_string)
-        else
-          rack_response.body = body_string
-        end
-        update_content_length(body_string.bytesize) if successfully_updated_body
-      end
-
-      # Set the length header for this response. This value should be set ot the
-      # bytesize, NOT THE LENGTH, of the response body. Otherwise, we may get
-      # got by the Lint thing.
-      CONTENT_LENGTH_HEADER = 'Content-Length'.cs__freeze
-      def update_content_length length
-        headers[CONTENT_LENGTH_HEADER] = length.to_s
-      end
-
       private
 
       HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
 
-      def update_rack_body_proxy body_string, is_array = false
-        top_body_proxy = is_array ? rack_response[2] : rack_response
-        parent_body_proxy = top_body_proxy
-        until (next_body = parent_body_proxy.instance_variable_get(:@body)).cs__class != Rack::BodyProxy
-          parent_body_proxy = next_body
-        end
-
-        if next_body.cs__class.to_s == 'ActionDispatch::Response::RackBody'
-          modified_response = next_body.instance_variable_defined?(:@response) ? next_body.instance_variable_get(:@response) : nil
-          if modified_response
-            modified_response.body = body_string
-            next_body.instance_variable_set(:@response, modified_response)
-          end
-        elsif next_body.is_a?(Array) && next_body[0].cs__class.to_s == 'ActionView::OutputBuffer'
-          new_body = ActionView::OutputBuffer.new(body_string)
-          next_body[0] = new_body
-        else
-          logger.warn('Detected unsupported Rack::BodyProxy internal response class', module: next_body.cs__class)
-          return false
-        end
-        true
-      end
-
       # Given some holder of the content of the response's body, extract that
       # content and return it as a String
       #

data/lib/contrast/agent/scope.rb

@@ -107,7 +107,7 @@ module Contrast
         def ensure_valid_scope! scope_sym
           unless valid_scope? scope_sym # rubocop:disable Style/GuardClause
             with_contrast_scope do
-              raise NotImplementedError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
+              raise NoMethodError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
             end
           end
         end

data/lib/contrast/agent/service_heartbeat.rb

@@ -2,38 +2,36 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent
     # The ServiceHeartbeat functions to keep the Contrast Service alive and
     # ensure that it maintains this Agent's ApplicationContext.
-    class ServiceHeartbeat
+    class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging
+      access_component :logging
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      def updater_thread
-        @_updater_thread ||= Contrast::Agent::Thread.new do
+      def start_thread!
+        return if running?
+
+        @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
             begin
-              CONTRAST_SERVICE.queue_message(poll_message)
+              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
             end
             sleep REFRESH_INTERVAL_SEC
           end
         end
       end
-      alias_method :start, :updater_thread
 
       def poll_message
         @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
-
-      def stop
-        Thread.kill(@_updater_thread) if @_updater_thread&.alive?
-      end
     end
   end
 end

data/lib/contrast/agent/static_analysis.rb

@@ -11,7 +11,7 @@ module Contrast
     class StaticAnalysis
       include Singleton
       include Contrast::Components::Interface
-      access_component :logging, :analysis, :contrast_service, :scope
+      access_component :logging, :analysis, :scope
       class << self
         # After the first request is complete, we do a one-time manual catchup to review and
         # report the already-loaded gems.
@@ -33,8 +33,7 @@ module Contrast
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
 
           Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
-
-          CONTRAST_SERVICE.queue_message app_update_msg
+          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
         end
       end
     end

data/lib/contrast/agent/thread_watcher.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/service_heartbeat'
+
+module Contrast
+  module Agent
+    # This class used to ensure that our worker threads are running in multi-process environments
+    class ThreadWatcher
+      include Contrast::Components::Interface
+      access_component :logging
+
+      attr_reader :heartbeat
+
+      def initialize
+        @pids = {}
+        @heartbeat = Contrast::Agent::ServiceHeartbeat.new
+      end
+
+      def startup!
+        unless heartbeat.running?
+          logger.debug('Attempting to start heartbeat thread')
+          heartbeat.start_thread!
+        end
+        heartbeat_result = heartbeat.running?
+        logger.debug('Heartbeat thread status', alive: heartbeat_result)
+
+        unless Contrast::Agent.messaging_queue.running?
+          logger.debug('Attempting to start messaging queue thread')
+          Contrast::Agent.messaging_queue.start_thread!
+        end
+        messaging_result = Contrast::Agent.messaging_queue.running?
+        logger.debug('Messaging thread status', alive: messaging_result)
+
+        logger.debug('ThreadWatcher started threads')
+
+        @pids[Process.pid] = messaging_result && heartbeat_result
+      end
+
+      def ensure_running?
+        return if @pids[Process.pid] == true
+
+        logger.debug('ThreadWatcher - threads not running')
+        startup!
+      end
+    end
+  end
+end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.11.0'
+    VERSION = '3.13.1'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Base class for threads that do async processing
+    class WorkerThread
+      def initialize
+        @_thread = nil
+      end
+
+      def running?
+        !!@_thread&.alive?
+      end
+
+      def stop!
+        return unless running?
+
+        Thread.kill(@_thread)
+        @_thread = nil
+      end
+    end
+  end
+end

data/lib/contrast/api.rb

@@ -10,9 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm_pb'
-cs__scoped_require 'contrast/api/settings_pb'
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/api/settings.pb'
 cs__scoped_require 'contrast/api/decorators'
-cs__scoped_require 'contrast/api/unix_socket'
-cs__scoped_require 'contrast/api/tcp_socket'
-cs__scoped_require 'contrast/api/speedracer'
+cs__scoped_require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to contain all modules that handle communication with speedracer
+    module Communication
+    end
+  end
+end
+
+cs__scoped_require 'contrast/api/communication/service_lifecycle'
+cs__scoped_require 'contrast/api/communication/connection_status'
+cs__scoped_require 'contrast/api/communication/socket'
+cs__scoped_require 'contrast/api/communication/tcp_socket'
+cs__scoped_require 'contrast/api/communication/unix_socket'
+cs__scoped_require 'contrast/api/communication/socket_client'
+cs__scoped_require 'contrast/api/communication/messaging_queue'
+cs__scoped_require 'contrast/api/communication/response_processor'
+cs__scoped_require 'contrast/api/communication/speedracer'

data/lib/contrast/api/communication/connection_status.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Keeps track of the state of connections to the service.
+      class ConnectionStatus
+        def initialize
+          @last_success = nil
+          @last_failure = nil
+          @startup_messages_sent = false
+        end
+
+        # Whether we have sent startup message to the service. True after successfully
+        # sending startup messages to service and reset to false if we lose connection
+        # to the service.
+        def startup_messages_sent?
+          @startup_messages_sent
+        end
+
+        # The last message sent was successful
+        def connected?
+          @last_success && (@last_failure.nil? || @last_success > @last_failure)
+        end
+
+        # The current state of the service is active with a successful message sent
+        def success!
+          @startup_messages_sent = true
+          @last_success = Time.now.to_f
+        end
+
+        # The service may be in some sort of error state
+        def failure!
+          @startup_messages_sent = false
+          @last_failure = Time.now.to_f
+        end
+      end
+    end
+  end
+end