contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/{agent/logger.rb → logger/log.rb}

@@ -5,62 +5,17 @@ cs__scoped_require 'logger'
 cs__scoped_require 'ougai'
 cs__scoped_require 'singleton'
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/logger/application'
+cs__scoped_require 'contrast/logger/format'
+cs__scoped_require 'contrast/logger/time'
 
 module Contrast
-  module Ougai
-    # Our decorator for the Ougai logger allowing for timing and with_level
-    # methods.
-    module Logger
-      # Log the message at the given level.
-      #
-      # @param level [String] the name of the method to use. Should be one of
-      #   trace, debug, info, warn, error
-      # @param message [String] the message to log
-      def with_level level, message
-        send(level.to_sym, message)
-      end
-
-      # Log, at the debug level, the action with a message including the time
-      # it took for the wrapped function to complete.
-      #
-      # @param msgs [Array<Object>] the arguments to pass to the logger.
-      #   msgs[0] will be modified to include the elapsed time.
-      # @param block [Block, Proc] the block to execute
-      def debug_with_time *msgs, &block
-        log_with_time(:debug, *msgs, &block)
-      end
-
-      # Log, at the trace level, the action with a message including the time
-      # it took for the wrapped function to complete.
-      #
-      # @param msgs [Array<Object>] the arguments to pass to the logger.
-      #   msgs[0] will be modified to include the elapsed time.
-      # @param block [Block, Proc] the block to execute
-      def trace_with_time *msgs, &block
-        log_with_time(:trace, *msgs, &block)
-      end
-
-      private
-
-      def log_with_time level, *msgs
-        a = Contrast::Utils::Timer.now_ms
-        ret = yield if block_given?
-        z = Contrast::Utils::Timer.now_ms
-        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
-        send(level, *msgs)
-        ret
-      end
-    end
-  end
-end
-
-module Contrast
-  module Agent
+  module Logger
     # This class functions to serve as a wrapper around our logging, as we need
     # to be able to dynamically update level based on updates to TeamServer.
-    class Logger
+    class Log
       include Singleton
       include Contrast::Components::Interface
       access_component :config
@@ -76,8 +31,6 @@ module Contrast
 
       def initialize
         update
-      rescue StandardError => e
-        logger.error('Unable to initialize regular logger in LoggerManager.', e)
       end
 
       # Given new settings from TeamServer, update our logging to use the new
@@ -102,10 +55,14 @@ module Contrast
         @previous_level = level_const
 
         @_logger = build(path: path, level_const: level_const)
-
-        logger.debug('Initialized new contrast agent logger')
+        log_update
       rescue StandardError => e
-        logger.error('Unable to process update to LoggerManager.', e)
+        if logger
+          logger.error('Unable to process update to LoggerManager.', e)
+        else
+          puts 'Unable to process update to LoggerManager.'
+          puts e.backtrace.join("\n")
+        end
       end
 
       def logger
@@ -131,13 +88,19 @@ module Contrast
                  else
                    ::Ougai::Logger.new(path)
                  end
-        logger.extend(Contrast::Ougai::Logger)
+        add_contrast_loggers(logger)
         logger.progname = 'Contrast Agent'
         logger.level = level_const
+        logger.formatter = Contrast::Logger::Format.new
         logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
         logger
       end
 
+      def add_contrast_loggers logger
+        logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Time)
+      end
+
       def valid_path path
         path = path.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : path
         return path if path == STDOUT_STR
@@ -146,13 +109,15 @@ module Contrast
         path = DEFAULT_NAME if path.empty?
         if write_permission?(path)
           path
+        elsif write_permission?(DEFAULT_NAME)
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
+          DEFAULT_NAME
         else
-          if File.directory?(path)
-            logger.error('Unable to create log in directory. Writing to standard out instead', path: path)
-          else
-            logger.error('Unable to write to log file. Writing to standard out instead', path: path)
-          end
-
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead." if previous_path != STDOUT_STR
           STDOUT_STR
         end
       end
@@ -168,6 +133,17 @@ module Contrast
       rescue StandardError
         DEFAULT_LEVEL
       end
+
+      # Log that the Agent log has changed and include some default information
+      # at the start of the log.
+      def log_update
+        logger.debug('Initialized new contrast agent logger')
+        logger.debug_with_time('middleware: log environment') do
+          logger.application_environment
+          logger.application_configuration
+          logger.application_libraries
+        end
+      end
     end
   end
 end

data/lib/contrast/logger/time.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for timing and with_level
+    # methods.
+    module Time
+      # Log the message at the given level.
+      #
+      # @param level [String] the name of the method to use. Should be one of
+      #   trace, debug, info, warn, error
+      # @param message [String] the message to log
+      def with_level level, message
+        send(level.to_sym, message)
+      end
+
+      # Log, at the debug level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def debug_with_time *msgs, &block
+        log_with_time(:debug, *msgs, &block)
+      end
+
+      # Log, at the trace level, the action with a message including the time
+      # it took for the wrapped function to complete.
+      #
+      # @param msgs [Array<Object>] the arguments to pass to the logger.
+      #   msgs[0] will be modified to include the elapsed time.
+      # @param block [Block, Proc] the block to execute
+      def trace_with_time *msgs, &block
+        log_with_time(:trace, *msgs, &block)
+      end
+
+      private
+
+      def log_with_time level, *msgs
+        a = Contrast::Utils::Timer.now_ms
+        ret = yield if block_given?
+        z = Contrast::Utils::Timer.now_ms
+        msgs[0] = "#{ msgs[0] }: pid=#{ Process.pid }, elapsed=#{ z - a }ms"
+        send(level, *msgs)
+        ret
+      end
+    end
+  end
+end

data/lib/contrast/tasks/config.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'yaml'
+
+module Contrast
+  # A Rake task to generate a contrast_security.yaml file with some basic settings
+  module Config
+    extend Rake::DSL
+    include Contrast::Components::Interface
+    DEFAULT_CONFIG = {
+        'api' => {
+            'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',
+            'api_key' => 'Enter your Contrast api key',
+            'service_key' => 'Enter your Contrast service key',
+            'user_name' => 'Enter your Contrast user name'
+        },
+        'agent' => {
+            'service' => {
+                'logger' => {
+                    'path' => 'contrast_service.log',
+                    'level' => 'ERROR' # DEBUG | INFO | WARN | ERROR
+                },
+                'socket' => '/tmp/contrast_service.sock'
+            },
+            'logger' => {
+                'level' => 'ERROR',
+                'path' => 'contrast_agent.log'
+            }
+        }
+    }.cs__freeze
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Create a contrast_security.yaml in the applications root directory'
+        task :create do
+          execution_directory = Dir.pwd
+          target_path = File.join(execution_directory, 'contrast_security.yaml')
+          if File.exist?(target_path)
+            puts 'WARNING: contrast_security.yaml already exists'
+          else
+            File.open(target_path, 'w') do |f|
+              f.write(YAML.dump(DEFAULT_CONFIG))
+            end
+
+            puts "Created contrast_security.yaml at #{ target_path }"
+            puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
+            puts 'Visit our documentation site for more details: https://docs.contrastsecurity.com/installation-rubyconfig.html'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/tasks/service.rb

@@ -43,8 +43,6 @@ module Contrast
         task :start do
           if Contrast::Utils::OS.running?
             puts 'Contrast Service already running. No need to start'
-          elsif !CONTRAST_SERVICE.enabled?
-            puts 'Contrast Service disabled by configuration. Not starting.'
           else
             start_service
           end
@@ -58,10 +56,8 @@ module Contrast
         task :status do
           if Contrast::Utils::OS.running?
             puts 'online'
-          elsif CONTRAST_SERVICE.enabled?
-            puts 'offline'
           else
-            puts 'disabled'
+            puts 'offline'
           end
         end
       end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -12,30 +12,55 @@ module Contrast
 
         access_component :logging
 
-        def self.tracked? obj
-          return false if obj.nil?
+        class << self
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def tracked? obj
+            _tracked?(obj, 0)
+          end
 
-          if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-            obj.each_pair do |k, v|
-              return true if tracked?(k)
-              return true if tracked?(v)
-            end
-            false
-          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-            obj.any? do |ele|
-              tracked?(ele) unless obj == ele
+          private
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def _tracked? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _tracked?(k, idx)
+                return true if _tracked?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _tracked?(ele, idx) unless obj == ele
+              end
+            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
+              obj.cs__tracked?
+            else
+              false
             end
-          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-            obj.cs__tracked?
-          else
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
-        rescue StandardError => e
-          # This is used to ask if a ton of objects are tracked. They may not
-          # all be iterable. Bad things could happen in some cases, like when
-          # checking a closed statement for SQL injection trigger events
-          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
-          false
         end
       end
     end

data/lib/contrast/utils/class_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast
@@ -56,7 +56,9 @@ module Contrast
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          if object.cs__is_a?(String)
+          # Only treat object like a string if it actually is a string
+          # some subclasses of String override string methods we depend on
+          if object.cs__class == String
             cached = to_cached_string(object)
             return cached if cached
 

data/lib/contrast/utils/gemfile_reader.rb

@@ -92,11 +92,11 @@ module Contrast
           usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
           usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
           activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
+          # TODO: RUBY-882 once TS switches to take filenames, remove the count setter and
           #   send the class names in usage.class_names
           usage.count = files.size
         end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
+        # TODO: RUBY-882 once TS switches to take filenames, clear this and remove the
         #   @updated variable
 
         # @spec_to_files.clear

data/lib/contrast/utils/hash_digest.rb

@@ -32,8 +32,8 @@ module Contrast
           request.parameters.each_key do |name|
             hash.update(name)
           end
-          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
-          hash.update(request.normalized_length_header(cl)) if cl
+          cl = request.headers[CONTENT_LENGTH_HEADER]
+          hash.update_on_content_length(cl) if cl
           hash.finish
         end
 
@@ -69,6 +69,8 @@ module Contrast
           hash.finish
         end
 
+        private
+
         def generate_crypto_hash finding, algorithm
           hash = new
           hash.update(finding.rule_id)
@@ -85,13 +87,6 @@ module Contrast
           hash.finish
         end
 
-        def generate_response_hash finding
-          hash = new
-          hash.update(finding.rule_id)
-          hash.update_on_request
-          hash.finish
-        end
-
         def generate_trigger_hash finding
           hash = new
           hash.update(finding.rule_id)
@@ -126,6 +121,15 @@ module Contrast
         end
       end
 
+      CHARS = %w[a b c d e f g].cs__freeze
+      # This method converts and integer value for length into a string value
+      # that we can hash on, based on the logarithmic value of the length, and
+      # updates the current hash with that value.
+      # @param chr [Numeric] the length to translate
+      def update_on_content_length chr
+        update(CHARS[Math.log10(chr.to_s.length).to_i] || CHARS[-1])
+      end
+
       def initialize
         @crc32 = 0
       end

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # customer applications, as determined by Configuration Rules at runtime.
     module InvalidConfigurationUtil
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :contrast_service, :logging
+      access_component :analysis, :app_context, :logging
 
       CS__PATH = 'path'
       CS__SESSION_ID = 'sessionId'
@@ -44,29 +44,13 @@ module Contrast
         activity = Contrast::Api::Dtm::Activity.new
         activity.findings << finding
 
-        # If assess is enabled, we can just send the activity
-        if ASSESS.enabled?
-          build_tags(activity)
-          CONTRAST_SERVICE.queue_message activity
-        # Otherwise, if the Agent isn't ready, we have to queue the messages
-        # until we know the starting state.
-        else
-          Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
-        end
+        Contrast::Agent.messaging_queue.send_event_eventually(activity)
       rescue StandardError => e
         logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private
 
-      # This seems silly to pull out, but we can ONLY call this in the case
-      # where we have a configuration. Doing otherwise results in a bad error
-      # case where we try to do other things, like logging, which behave
-      # strangely without a config
-      def build_tags activity
-        activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-      end
-
       def file_snippet file_path, call_location
         idx = call_location&.lineno
         if file_path && idx && File.exist?(file_path)