contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/sinatra_helper'
 cs__scoped_require 'rubygems/version'
 
 module Contrast
@@ -16,13 +15,17 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :agent, :config
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
         DEFAULT_SERVER_NAME = 'localhost'
         DEFAULT_SERVER_PATH = '/'
 
+        def initialize
+          original_pid
+        end
+
         def server_type
           @_server_type ||= begin
                               tmp = CONFIG.root.server.type
@@ -118,6 +121,28 @@ module Contrast
         def instrument_middleware_stack?
           !Contrast::Utils::JobServersRunning.job_servers_running?
         end
+
+        def disabled_agent_rake_tasks
+          CONFIG.root.agent.ruby.disabled_agent_rake_tasks
+        end
+
+        # Determines if the Process we're currently in matches that of the
+        # Process in which the App Context instance was created.
+        # If it doesn't, that indicates the running context is in a new
+        # Process.
+        # @return [Boolean] if we're in the original Process in which the
+        #   App Context instance was initialized.
+        def in_new_process?
+          current_pid = Process.pid
+          original_pid = pid
+          current_pid != original_pid
+        end
+
+        private
+
+        def original_pid
+          @_original_pid ||= Process.pid
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/assess.rb

@@ -12,12 +12,14 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :settings
+        access_component :config, :settings
 
         def enabled?
-          return false unless defined?(Contrast::Agent::FeatureState)
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
 
-          state.assess_enabled?
+          SETTINGS.assess_enabled?
         end
 
         def tainted_columns
@@ -25,39 +27,47 @@ module Contrast
         end
 
         def forcibly_disabled?
-          state.assess_forcibly_disabled?
+          @_forcibly_disabled = false?(CONFIG.root.assess.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled
         end
 
         def rule_disabled? name
-          state.assess_rule_disabled? name
-        end
-
-        def disabled_rules
-          state.assess_disabled_rules
+          disabled_rules.include?(name)
         end
 
         def scan_response?
-          state.scan_response?
+          @_scan_response = !false?(CONFIG.root.assess.enable_scan_response) if @_scan_response.nil?
+          @_scan_response
         end
 
         def track_frozen_sources?
-          state.assess_track_frozen_sources?
+          @_track_frozen_sources = !false?(CONFIG.root.agent.ruby.track_frozen_sources) if @_track_frozen_sources.nil?
+          @_track_frozen_sources
         end
 
         def require_scan?
-          state.require_scanning_enabled?
+          @_require_scan = !false?(CONFIG.root.agent.ruby.require_scan) if @_require_scan.nil?
+          @_require_scan
         end
 
         def tags
-          state.assess_tags
+          CONFIG.root.assess&.tags
         end
 
         def rules
           SETTINGS.assess_rules
         end
 
-        def rule name
-          SETTINGS.assess_rules[name]
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(CONFIG.root.assess.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
+
+        def disabled_rules
+          # TODO: RUBY-903
+          CONFIG.root.assess&.rules&.disabled_rules || SETTINGS.disabled_assess_rules || []
         end
       end
 

data/lib/contrast/components/config.rb

@@ -3,6 +3,7 @@
 
 cs__scoped_require 'contrast/utils/boolean_util'
 cs__scoped_require 'contrast/utils/env_configuration_item'
+cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/configuration'
 
 module Contrast
@@ -69,17 +70,11 @@ module Contrast
         end
 
         def session_id
-          @_session_id ||= begin
-                             s = raw.application.session_id || ''
-                             s.empty? ? nil : s
-                           end
+          @_session_id ||= raw.application.session_id || Contrast::Utils::ObjectShare::EMPTY_STRING
         end
 
         def session_metadata
-          @_session_metadata ||= begin
-                                   s = raw.application.session_metadata || ''
-                                   s.empty? ? nil : s
-                                 end
+          @_session_metadata ||= raw.application.session_metadata || Contrast::Utils::ObjectShare::EMPTY_STRING
         end
 
         def valid?
@@ -98,7 +93,7 @@ module Contrast
           # If the config is invalid, and you want to know about it, then
           # you have a circular dependency if you try to log it,
           # hence `log: false`.
-          if session_id && session_metadata
+          if !session_id.empty? && !session_metadata.empty?
             if log
               cs__class.log_error(SESSION_VARIABLES)
             else

data/lib/contrast/components/contrast_service.rb

@@ -15,18 +15,24 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config, :agent
+        DEFAULT_SERVICE_LOG = 'contrast_service.log'
+        # The Rails ActionDispatch regexp for localhost IP + literal localhost
+        # https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/http/request.rb#L32
+        LOCALHOST = Regexp.union [/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, /^::1$/, /^0:0:0:0:0:0:0:1(%.*)?$/, /^localhost$/]
 
-        def update_received?
-          state.update_received?
-        end
-
-        def enabled?
-          state.service_enabled?
-        end
+        access_component :agent, :config
 
-        def disabled?
-          state.service_forcibly_disabled?
+        def use_bundled_service?
+          # Validates the config to decide if it's suitable for starting
+          # the bundled service
+          @_use_bundled_service ||= begin
+                                      # Requirement says "must be true" but that
+                                      # should be "must not be false" -- oops.
+                                      !false?(CONFIG.root.agent.start_bundled_service) &&
+                                          # Either a valid host or a valid socket
+                                          # Path validity is the service's problem
+                                          (LOCALHOST.match?(host) || !!socket_path)
+                                    end
         end
 
         def host
@@ -34,76 +40,26 @@ module Contrast
         end
 
         def port
-          @_port ||= (CONFIG.root.agent.service.port || Contrast::Configuration::DEFAULT_PORT).to_i
+          @_port ||= (CONFIG.root.agent.service.port || DEFAULT_PORT).to_i
         end
 
         def socket_path
           @_socket_path ||= CONFIG.root.agent.service.socket
         end
 
-        def logger_path
-          @_logger_path ||= CONFIG.root.agent.service.logger.path || DEFAULT_LOG_FILENAME
-        end
-
         def use_tcp?
           socket_path.nil?
         end
 
-        def last_update
-          state.last_update
-        end
-
-        def use_bundled_service?
-          # Validates the config to decide if it's suitable for starting
-          # the bundled service
-          @_use_bundled_service ||= begin
-                                      # Requirement says "must be true" but that
-                                      # should be "must not be false" -- oops.
-                                      !false?(CONFIG.root.agent.start_bundled_service) &&
-                                          # Either a valid host or a valid socket
-                                          ((CONFIG.root.agent.service.host.nil? ||
-                                          CONFIG.root.agent.service.host == 'localhost' ||
-                                          CONFIG.root.agent.service.host == '127.0.0.1') ||
-                                          # Path validity is the service's problem
-                                          !!CONFIG.root.agent.service.socket)
-                                    end
-        end
-
-        # TODO: As part of RUBY-356. Add new handling for SQL analysis via RPC (SPEED-211)
-
-        # The API for Agent to Service communication. These methods abstract away implementation
-        # details, responsibilities of sending messages to the service, and requirements mandated
-        # within the Agent<>SpeedRacer contract.
-
-        # Pushes a message onto a queue to later be consumed when the service sender thread is ready to
-        # handle it. The service response is not returned; rather, it is processed by the service sender
-        # thread. All messages sent to SpeedRacer should be queued rather than sent unless the calling method
-        # explicitly needs to act on the response object with custom logic (i.e. RequestContext#service_extract_response)
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
-        #  field of Contrast::Api::Dtm::Message
-        # TODO: rename method to queue_event
-        def queue_message event
-          return unless event
-
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(event)
+        def logger_path
+          @_logger_path ||= CONFIG.root.agent.service.logger.path || DEFAULT_SERVICE_LOG
         end
 
-        # TODO: RUBY-662. Add additional check before we queue/send a message to see if we were unable
-        # to connect to the service.
+        private
 
-        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
-        # to receive the response object back from SpeedRacer. An invoking method that needs
-        # to process the response object with custom logic should use this method.
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
-        #   field of Contrast::Api::Dtm::Message
-        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
-        # TODO: rename method to send_event
-        def send_message event
-          return unless event
-
-          state.client.send_to_speedracer(event)
+        def disabled?
+          @_disabled = false?(CONFIG.root.agent.start_bundled_service) if @_disabled.nil?
+          @_disabled
         end
       end
 

data/lib/contrast/components/interface.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'delegate'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/boolean_util'
 
 module Contrast
@@ -56,14 +56,6 @@ module Contrast
         def true? config_param
           Contrast::Utils::BooleanUtil.true?(config_param)
         end
-
-        # TODO: RUBY-536
-        private
-
-        def _state_shim
-          Contrast::Agent::FeatureState.instance
-        end
-        alias_method :state, :_state_shim
       end
     end
 
@@ -128,7 +120,7 @@ module Contrast
 
             @_access_component[sym] = true
           else
-            raise NotImplementedError, "#{ self } asked to access undefined component '#{ sym }'."
+            raise NoMethodError, "#{ self } asked to access undefined component '#{ sym }'."
           end
         end
       end
@@ -164,12 +156,12 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] =
 cs__scoped_require 'contrast/components/agent'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
 
-cs__scoped_require 'contrast/components/app_context'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]
-
 cs__scoped_require 'contrast/components/contrast_service'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] = [Contrast::Components::ContrastService]
 
+cs__scoped_require 'contrast/components/app_context'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]
+
 cs__scoped_require 'contrast/components/heap_dump'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:heap_dump] = [Contrast::Components::HeapDump]
 

data/lib/contrast/components/inventory.rb

@@ -11,9 +11,13 @@ module Contrast
       # product.
       class Interface
         include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :config
 
         def enabled?
-          state.inventory_enabled?
+          @_enabled = !false?(CONFIG.root.inventory.enable) if @_enabled.nil?
+          @_enabled
         end
       end
 

data/lib/contrast/components/logger.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/logger'
+cs__scoped_require 'contrast/logger/log'
 
 module Contrast
   module Components
     module Logger
       module InstanceMethods #:nodoc:
         def logger
-          Contrast::Agent::Logger.instance.logger
+          Contrast::Logger::Log.instance.logger
         end
       end
       ClassMethods = InstanceMethods

data/lib/contrast/components/protect.rb

@@ -13,23 +13,59 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :settings
+        access_component :config, :settings
 
         def enabled?
-          state.protect_enabled?
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
+
+          SETTINGS.protect_enabled?
         end
 
-        def forcibly_disabled?
-          state.protect_forcibly_disabled?
+        def rule_config
+          CONFIG.root.protect.rules
         end
 
         def rules
           SETTINGS.protect_rules
         end
 
+        def rule_mode rule_id
+          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+        end
+
         def rule name
           SETTINGS.protect_rules[name]
         end
+
+        def report_any_command_execution?
+          if @_report_any_command_execution.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::CmdInjection::NAME]
+            @_report_any_command_execution = true?(ctrl.disable_system_commands)
+          end
+          @_report_any_command_execution
+        end
+
+        def report_custom_code_sysfile_access?
+          if @_report_custom_code_sysfile_access.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::PathTraversal::NAME]
+            @_report_custom_code_sysfile_access = true?(ctrl.detect_custom_code_accessing_system_files)
+          end
+          @_report_custom_code_sysfile_access
+        end
+
+        def forcibly_disabled?
+          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled
+        end
+
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/scope.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
 cs__scoped_require 'fiber'
+cs__scoped_require 'monitor'
 cs__scoped_require 'contrast/agent/scope'
 
 # This is the Scope component.
@@ -54,7 +54,7 @@ module Contrast
           end
         end
 
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
+        # TODO: RUBY-572
         #
         # Current behavior is to no-op if we're not "in a request context".
         # Our C functions were previously checking to see if we had a scope, because
@@ -84,53 +84,3 @@ module Contrast
     end
   end
 end
-
-# This is a reasonable place for the Kernel#catch hook to live.
-# No current plans for component re-design, but if we had some kind of
-# "do this when a component is hooked in" thing, this would live there.
-# For now, it's over-engineering to live anywhere else.  -ajm
-module Kernel # :nodoc:
-  alias_method :cs__catch, :catch
-
-  # In the event of a `throw`, we need to override `catch`
-  # to save & restore scope state:
-  #
-  #   scope_level == 0
-  #
-  #   catch(:abc) do
-  #     with_contrast_scope do
-  #       throw :abc # will leak
-  #     end
-  #   end
-  #
-  #   scope_level == 1
-  #
-  # Frankly, this isn't how scope should be used.  This is in place of
-  # proper `ensure` blocks within the instrumentation call stack.
-  # This will actually /create/ scope leaks if you're doing something like:
-  #
-  #   catch(:ohno) do
-  #     enter scope
-  #   end
-  #
-  #   abc()
-  #
-  #   exit scope
-  #
-  # i.e. if you intend to change net scope across a catch block boundary.
-
-  private
-
-  def catch *args, &block
-    # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
-
-    # Run original catch with block.
-    retval = cs__catch(*args, &block)
-
-    # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
-
-    retval
-  end
-end