contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/api/connection_status.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Api
-    # Keeps track of the state of connections to the service.
-    class ConnectionStatus
-      def initialize
-        @last_success = nil
-        @last_failure = nil
-        @startup_messages_sent = false
-      end
-
-      # Whether we have sent startup message to the service. True after successfully
-      # sending startup messages to service and reset to false if we lose connection
-      # to the service.
-      def startup_messages_sent?
-        @startup_messages_sent
-      end
-
-      # A message was successfully sent to the service at some point
-      def was_connected?
-        @last_success
-      end
-
-      # The last message sent was successful
-      def connected?
-        @last_success && (@last_failure.nil? || @last_success > @last_failure)
-      end
-
-      # The last message sent was unsuccessful
-      def failed?
-        @last_failure && (@last_success.nil? || @last_failure > @last_success)
-      end
-
-      # The current state of the service is active with a successful message sent
-      def success!
-        @startup_messages_sent = true
-        @last_success = Time.now.to_f
-      end
-
-      # The service may be in some sort of error state
-      def failure!
-        @startup_messages_sent = false
-        @last_failure = Time.now.to_f
-      end
-    end
-  end
-end

data/lib/contrast/api/decorators/exclusion.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/api/settings_pb'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the Contrast::Api::Settings::Exclusion protobuf model
-      # to allow for renaming of fields.
-      module Exclusion
-        def denylist
-          blacklist
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Settings::Exclusion.include(Contrast::Api::Decorators::Exclusion)

data/lib/contrast/api/socket.rb

@@ -1,43 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Api
-    # Behavior common to all sockets used
-    # to communicate with the Contrast Service.
-    module Socket
-      SOCKET_MONITOR = Monitor.new
-
-      # Send a message across the socket and read back the response.
-      # @param marshaled [String] some marshaled form of data to be sent across
-      #   the socket. Typically an encoded form of Contrast::Api::Dtm::Message.
-      # @return [String] some marshalled form of data returned by the socket.
-      #   Typically an encoded form of Contrast::Api::Settings::AgentSettings.
-      def send_marshaled marshaled
-        SOCKET_MONITOR.synchronize do
-          socket = new_socket
-
-          # write message length
-          len = marshaled.length
-          socket.write([len].pack(Contrast::Api::ENCODING_STRING))
-
-          # write the entire message
-          socket.write(marshaled)
-          socket.close_write
-
-          # read the response length
-          len = socket.read(4).unpack1(Contrast::Api::ENCODING_STRING)
-
-          # read expected response to end
-          socket.read(len)
-        end
-      end
-
-      # Override this method to return a socket.
-      # Should be interface compatible with TCPSocket, UNIXSocket, etc.
-      def new_socket
-        raise NotImplementedError, 'This is abstract, override it.'
-      end
-    end
-  end
-end

data/lib/contrast/api/speedracer.rb

@@ -1,188 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/os'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Api
-    # This class acts as the interface for the communication between the Agent
-    # and the Service (SpeedRacer) as well as functions as a way for the Agent
-    # to manage the bundled Service.
-    class Speedracer
-      include Contrast::Components::Interface
-      access_component :app_context, :contrast_service, :logging
-
-      attr_reader :client_number,
-                  :host,
-                  :port,
-                  :socket,
-                  :connection
-
-      @instance_count = 0
-      @instance_mutex = Mutex.new
-
-      def self.next_client_number
-        @instance_mutex.synchronize do
-          @instance_count += 1
-        # Rollover things
-        rescue StandardError
-          @instance_count = 1
-        end
-      end
-
-      def self.read_only_instance_count
-        @instance_count.dup
-      end
-
-      def initialize connection
-        @client_number = Contrast::Api::Speedracer.next_client_number
-        @messages_total = 0
-
-        @pid = Process.pid.to_i
-        @ppid = Process.ppid.to_i
-        @connection = connection
-      end
-
-      # Allow for the start of a Service, but block so that we only attempt to
-      # start the service one try at a time in the case multiple threads are
-      # trying to send messages.
-      def start_service
-        zombie_check
-        service_starter_thread.join(5)
-        is_service_started = Contrast::Utils::OS.running?
-        logger.error('The bundled service could not be started. The agent will not function properly.') unless is_service_started
-        is_service_started
-      end
-
-      # Wrap the given DTM in a Contrast::Api::Dtm::Message and send it to the
-      # Service for processing
-      #
-      # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
-      #   Contrast::Api::Dtm::Message
-      def send_one event
-        msg = build_message(event)
-        send_message(msg)
-      end
-
-      private
-
-      # check if there's a zombie service that exists, and wait on it if so.
-      # currently, this only happens when trying to initialize speedracer
-      def zombie_check
-        zombie_pid_list = Contrast::Utils::OS.zombie_pids
-        zombie_pid_list.each do |pid|
-          Process.wait(pid.to_i)
-        end
-      end
-
-      def determine_startup_options
-        return { out: :out, err: :err } if Contrast::Agent::FeatureState.instance.service_control[:logger_path] == 'STDOUT'
-
-        { out: File::NULL, err: File::NULL }
-      end
-
-      # This is a separate method so we can overwrite it globally in specs
-      def spawn_service
-        options = determine_startup_options
-        spawn 'contrast_service', options
-      end
-
-      def service_starter_thread
-        Contrast::Agent::Thread.new do
-          # Always check to see if it already started
-          unless Contrast::Utils::OS.running?
-            # Spawn the service process
-            spawn_service
-            # Block until service is running
-            sleep(0.1) until Contrast::Utils::OS.running?
-          end
-        end
-      end
-
-      # Wrap the given event in a Contrast::Api::Dtm::Message
-      #
-      # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
-      #   Contrast::Api::Dtm::Message
-      # @return Contrast::Api::Dtm::Message
-      def build_message event
-        message = base_message
-        case event
-        when Contrast::Api::Dtm::ServerActivity
-          message.server_activity = event
-        when Contrast::Api::Dtm::AgentStartup
-          message.agent_startup = event
-        when Contrast::Api::Dtm::ApplicationCreate
-          message.application_create = event
-        when Contrast::Api::Dtm::ApplicationUpdate
-          message.application_update = event
-        when Contrast::Api::Dtm::Activity
-          message.activity = event
-        when Contrast::Api::Dtm::HttpRequest
-          message.prefilter = event
-        when Contrast::Api::Dtm::HttpResponse
-          message.postfilter = event
-        when Contrast::Api::Dtm::Poll
-          message.poll = event
-        when Contrast::Api::Dtm::ObservedRoute
-          message.observed_route = event
-        else
-          logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
-          return
-        end
-        logger.debug('Wrapping event in message',
-                     msg_id: message.__id__,
-                     p_id: message.pid,
-                     msg_count: message.message_count,
-                     event_id: event.__id__,
-                     event_type: event.cs__class.name)
-        message
-      end
-
-      def base_message
-        msg               = Contrast::Api::Dtm::Message.new
-        msg.app_name      = APP_CONTEXT.name
-        msg.app_path      = APP_CONTEXT.path
-        msg.app_language  = Contrast::Utils::ObjectShare::RUBY
-        msg.client_id     = APP_CONTEXT.client_id
-        msg.client_number = client_number
-        msg.client_total  = Contrast::Api::Speedracer.read_only_instance_count
-        msg.message_count = (@messages_total += 1)
-        msg.pid           = APP_CONTEXT.pid
-        msg.ppid          = APP_CONTEXT.ppid
-        msg
-      end
-
-      def send_message msg
-        return unless msg
-
-        logger.debug('Sending message.',
-                     msg_id: msg.__id__,
-                     p_id: msg.pid,
-                     msg_count: msg.message_count)
-        to_service = Contrast::Api::Dtm::Message.encode(msg)
-        from_service = send_marshaled(to_service)
-        response = Contrast::Api::Settings::AgentSettings.decode(from_service)
-        logger.debug('Received response.',
-                     msg_id: msg.__id__,
-                     p_id: msg.pid,
-                     msg_count: msg.message_count,
-                     response_id: response&.__id__)
-        response
-      rescue StandardError => e
-        logger.error('Sending failed for message.',
-                     e,
-                     msg_id: msg.__id__,
-                     p_id: msg.pid,
-                     msg_count: msg.message_count,
-                     response_id: response&.__id__)
-        raise e # reraise to let SocketClient manage the connection
-      end
-
-      def send_marshaled marshaled
-        connection.send_marshaled(marshaled)
-      end
-    end
-  end
-end

data/lib/contrast/api/tcp_socket.rb

@@ -1,29 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/api/socket'
-
-module Contrast
-  module Api
-    # This class allows us to create a TCP Socket to communicate to the Service
-    # (Speed Racer). Either it or the Unix Socket will be used, as determined
-    # by the configuration options set for Service communication.
-    class TcpSocket
-      include Contrast::Api::Socket
-
-      attr_reader :host, :port
-
-      # Create the socket
-      # @param host [String] socket target hostname or IP address
-      # @param port [String,Integer] socket target port
-      def initialize host, port
-        @host = host.to_s
-        @port = port.to_i
-      end
-
-      def new_socket
-        ::TCPSocket.new(host, port)
-      end
-    end
-  end
-end

data/lib/contrast/api/unix_socket.rb

@@ -1,25 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/api/socket'
-
-module Contrast
-  module Api
-    # Implements a UNIX domain socket to connect to the Contrast Service.
-    class UnixSocket
-      include Contrast::Api::Socket
-
-      attr_reader :path
-
-      # Create the socket
-      # @param path [String] file path to a UNIX domain socket
-      def initialize path
-        @path = path
-      end
-
-      def new_socket
-        ::UNIXSocket.new(path)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/cookie.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Rack
-  module Session
-    # Our patch into the Rack::Session::Cookie Class, allowing for the
-    # runtime detection of insecure configurations on individual cookies
-    # within the application
-    class Cookie
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      access_component :scope
-
-      alias_method :cs__patched_initialize, :initialize
-      def initialize app, options = {}
-        Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
-        cs__patched_initialize(app, options)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/request.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Request class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Request
-    unless Rack::Request.instance_methods(true).include?(:set_header)
-      def set_header name, value
-        @env[name] = value
-      end
-    end
-
-    unless Rack::Request.instance_methods(true).include?(:get_header)
-      def get_header name
-        @env[name]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/response.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Response Class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Response
-    unless Rack::Response.instance_methods(true).include?(:set_header)
-      def set_header key, value
-        headers[key] = value
-      end
-    end
-    unless Rack::Response.instance_methods(true).include?(:get_header)
-      def get_header key
-        headers[key]
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rails/action_controller_inheritance.rb

@@ -1,39 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module ActionController
-  module Railties
-    # Used to monkey patch all the inherited calls in action_pack
-    #
-    # This is the usual entry point for Rails inheritance work, so it should
-    # catch most of the calls to inherited.
-    module Helpers
-      alias_method :cs__patched_inherited, :inherited
-      def inherited klass
-        klass&.instance_variable_set(:@cs__defining_class, true)
-        cs__patched_inherited(klass)
-      ensure
-        klass&.instance_variable_set(:@cs__defining_class, false)
-      end
-    end
-  end
-end
-
-module ActiveRecord
-  module AttributeMethods
-    # Used to monkey patch all the inherited calls in action_pack
-    module TimeZoneConversion
-      module ClassMethods #:nodoc:
-        private
-
-        alias_method :cs__patched_inherited, :inherited
-        def inherited klass
-          klass&.instance_variable_set(:@cs__defining_class, true)
-          cs__patched_inherited(klass)
-        ensure
-          klass&.instance_variable_set(:@cs__defining_class, false)
-        end
-      end
-    end
-  end
-end