contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/agent/assess/rule/redos.rb

@@ -54,7 +54,6 @@ module Contrast
               # will have the same functional characteristics as the original.
               # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
               # Regexp#source will give you the original source.
-              # TODO RUBY-683, would we ever get a hit on one but not the other?
 
               # Use #match? because it doesn't fill out global variables
               # in the way match or =~ do.

data/lib/contrast/agent/assess/tag.rb

@@ -7,28 +7,42 @@ module Contrast
       # A Tag represents a range in a given piece of data. It is used by the
       # Agent to determine if a vulnerable dataflow has occurred.
       class Tag
-        attr_reader :length,    # length of tagged text within string
+        attr_reader :label,     # the label of this tag
+                    :length,    # length of tagged text within string
                     :start_idx, # start of range
-                    :end_idx    # end of range (calculated from start + length)
+                    :end_idx    # end of range (calculated from start + length), exclusive
 
         # Initialize a new tag
-        # length : the length of the string described with this tag
-        # start_idx : (default: 0) the starting position in the string for this tag
-        def initialize length, start_idx = 0
+        #
+        # @param label [String] the lable of the tag
+        # @param length [Integer] the length of the string described with this
+        #   tag
+        # @param start_idx [Integer] (0) the starting position in the string for
+        #   this tag
+        def initialize label, length, start_idx = 0
+          @label = label
           update_range(start_idx, start_idx + length)
         end
 
         # Return true if the tag covers the given position in the string
+        #
+        # @param idx [Integer] the index to check
+        # @return [Boolean]
         def covers? idx
           idx >= start_idx && idx < end_idx
         end
 
         # Return true if the tag is above the given position in the string
+        # @param idx [Integer] the index to check
+        # @return [Boolean]
         def above? idx
           idx < start_idx
         end
 
-        # Return the range that this tag covers
+        # Return the range that this tag covers, from start (inclusive) to
+        # end (exclusive).
+        #
+        # @return [Range]
         def range
           start_idx...end_idx
         end
@@ -38,10 +52,11 @@ module Contrast
         end
 
         # Return if a given tag overlaps this one
-        def overlaps? other
-          return true if @start_idx <  other.start_idx && @end_idx >= other.start_idx  # we start below other & end in it
-          return true if @start_idx >= other.start_idx && @end_idx <= other.end_idx    # we start and end in other
-          return true if @start_idx <= other.end_idx   && @end_idx >  other.end_idx    # we start in other & end above it
+        def overlaps? start_idx, end_idx
+          return true if @start_idx <  start_idx && @end_idx >= start_idx  # we start below range & end in it
+          return true if @start_idx >= start_idx && @end_idx <= end_idx    # we start and end in range
+
+          @start_idx <= end_idx && @end_idx > end_idx                      # we start in range & end above it
         end
 
         def shift idx
@@ -71,7 +86,7 @@ module Contrast
         # Returns true if the other tag was merged into
         # this tag
         def merge other
-          return unless overlaps?(other)
+          return unless overlaps?(other.start_idx, other.end_idx)
 
           start = other.start_idx < @start_idx ? other.start_idx : @start_idx
           finish = other.end_idx > @end_idx ? other.end_idx : @end_idx
@@ -86,7 +101,7 @@ module Contrast
           new_start_idx = start >= 0 ? start : 0
           # If a tag were to go negative, cut off the negative portion from length
           new_length = start >= 0 ? length : (length + start)
-          Contrast::Agent::Assess::Tag.new(new_length, new_start_idx)
+          Contrast::Agent::Assess::Tag.new(label, new_length, new_start_idx)
         end
 
         def str_val

data/lib/contrast/agent/at_exit_hook.rb

@@ -8,7 +8,7 @@ module Contrast
     # This module adds an at_exit hook for us to send messages that may be lost at process exit
     module AtExitHook
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging
+      access_component :logging
       def self.exit_hook
         @_exit_hook ||= begin
                           at_exit do
@@ -29,7 +29,9 @@ module Contrast
                      process_pp_id: Process.ppid)
 
         context = Contrast::Agent::REQUEST_TRACKER.current
-        CONTRAST_SERVICE.send_message(context.activity) if context
+        return unless context
+
+        Contrast::Agent.messaging_queue.send_event_immediately(context.activity)
       end
     end
   end

data/lib/contrast/agent/class_reopener.rb

@@ -2,25 +2,30 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'ripper'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/logger/log'
 
 # This method is left purposefully at the top level namespace. Moving it
 # elsewhere will break functionality as it executes evaluations against the
 # namespace from which it is called -- ie putting it in Contrast would make all
 # changes it intends for Foo happen to Contrast::Foo instead
 #
-# @param class_name [String] the name of the class in which the eval will
+# @param _class_name [String] the name of the class in which the eval will
 #   redefine functionality
 # @param content [String] the String content that will function as the code in
 #   the given class
-def unbound_eval class_name, content
+def unbound_eval _class_name, content
   # Yuck, this is a top-level method that has to break encapsulation
   # in order to access scoping!
   Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope!
   eval(content) # rubocop:disable Security/Eval
 rescue Exception # rubocop:disable Lint/RescueException
-  Contrast::Agent::SettingsState.log_error("Unable to perform unbound eval of new content for #{ class_name }.")
+  # We can't use components here, so we have to access the log directly. I hate
+  # it, but we'll have to deal with it until we remove 2.5 support.
+  Contrast::Logger::Log.instance.logger.error('Unable to perform unbound eval of new content', module: class_name)
+  # And we need to return nil here, not the value from the logger.
+  nil
 ensure
   Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope!
 end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/api/decorators/exclusion.rb'
 
 module Contrast
   module Agent
@@ -93,7 +92,7 @@ module Contrast
       end
 
       def code?
-        @exclusion.type == :CODE
+        @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
       def name
@@ -101,7 +100,7 @@ module Contrast
       end
 
       def match_all?
-        @exclusion.match_strategy == :ALL
+        @exclusion.urls.nil? || @exclusion.urls.empty?
       end
 
       # Determine if the given rule is excluded by this exclusion.

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/inventory_util'
+
+module Contrast
+  module Agent
+    module Inventory
+      module Policy
+        # This Module is how we apply the Data Store detection required for the
+        # FlowMap feature. It is called from our patches of the targeted methods
+        # in which database operations occur. It is responsible for deciding if
+        # the given invocation is worth reporting or not.
+        module DataStores
+          class << self
+            include Contrast::Components::Interface
+
+            access_component :analysis, :logging
+            # The key used in policy.json to indicate the database type to
+            # report.
+            DATA_STORE_MARKER = 'data_store'
+
+            def report_data_store _method, _exception, properties, object, _args
+              return unless INVENTORY.enabled?
+
+              marker = properties[DATA_STORE_MARKER]
+              return unless marker
+
+              file_report(marker)
+            rescue StandardError => e
+              logger.error('Error reporting database call', e, object: object)
+            end
+
+            private
+
+            def file_report data_store
+              return unless data_store
+
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context&.activity
+
+              context.activity.query_count += 1
+              return unless context.activity.query_count == 1
+
+              Contrast::Utils::InventoryUtil.append_db_config(context.activity)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -5,7 +5,7 @@ cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
 cs__scoped_require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/extensions/ruby_core/inventory/datastores'
+cs__scoped_require 'contrast/agent/inventory/policy/datastores'
 
 module Contrast
   module Agent

data/lib/contrast/agent/middleware.rb

@@ -7,7 +7,6 @@ cs__scoped_require 'rack'
 
 cs__scoped_require 'contrast/security_exception'
 cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/agent/service_heartbeat'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/heap_dump_util'
 cs__scoped_require 'contrast/agent/request_handler'
@@ -15,8 +14,6 @@ cs__scoped_require 'contrast/agent/static_analysis'
 
 cs__scoped_require 'contrast/utils/timer'
 cs__scoped_require 'contrast/utils/freeze_util'
-cs__scoped_require 'contrast/utils/service_sender_util'
-cs__scoped_require 'contrast/utils/service_response_util'
 
 module Contrast
   module Agent
@@ -26,49 +23,45 @@ module Contrast
     # as it goes through the middleware stack inside of #call.
     class Middleware
       include Contrast::Components::Interface
-      access_component :agent, :logging, :scope
+      access_component :agent, :config, :logging, :scope, :settings
 
       attr_reader :app
 
       # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here
-      # since we're only going to be initialized a single time. Our initializatoin order is:
-      # - log environment, configuration, and all libraries
-      # - start the service sending thread, responsible for sending and processing messages
-      # - start the heartbeat thread, which triggers service startup
-      # - start instrumenting libraries and do a 'catchup' patch for everything we didn't see get loaded
-      # - enable TracePoint, which handles all class loads and required instrumentation going forward
+      # since we're only going to be initialized a single time. Our initialization order is:
+      # - capture the application
+      # - setup the Agent
+      # - startup the Agent
       #
       # @param app [Rack::Application] the application to be instrumented
       # @param _legacy_param [nil] was a flag we no longer need, but Sinatra may call it
-
       def initialize app, _legacy_param = nil
-        @app = app # THIS MUST BE FIRST AND ALWAYS SET!
-        # TODO: RUBY-545 nomenclature here needs to be updated.
-        #   enabled/initialized are really only reflective of whether we were able to parse the config,
-        #   which is the bare minimum for the agent to do anything.
+        @app = app  # THIS MUST BE FIRST AND ALWAYS SET!
+        setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
         unless AGENT.enabled?
           logger.error(
-              'Contrast middleware initializer detected an early-stage setup failure (likely config parse). Disabling.')
+              'The Agent was unable to initialize before the application middleware was initialized. Disabling permanently.')
           AGENT.disable! # ensure the agent is disabled (probably redundant)
           return
         end
         agent_startup_routine
       end
 
+      # Startup the Agent as part of the initialization process:
+      # - start the service sending thread, responsible for sending and
+      #   processing messages
+      # - start the heartbeat thread, which triggers service startup
+      # - start instrumenting libraries and do a 'catchup' patch for everything
+      #   we didn't see get loaded
+      # - enable TracePoint, which handles all class loads and required
+      #   instrumentation going forward
       def agent_startup_routine
-        logger.debug_with_time('middleware: log environment') do
-          settings.log_environment
-          settings.log_configuration
-          settings.log_specific_libraries
-          settings.log_all_libraries
-        end
-
         logger.debug_with_time('middleware: starting service') do
-          run_service_threads
+          Contrast::Agent.thread_watcher.ensure_running?
         end
 
         logger.debug_with_time('middleware: instrument shared libraries and patch') do
-          instrument_and_patch
+          Contrast::Agent::Patching::Policy::Patcher.patch
         end
 
         AGENT.enable_tracepoint
@@ -96,10 +89,27 @@ module Contrast
 
       private
 
+      def setup_agent
+        SETTINGS.reset_state
+
+        if CONFIG.invalid?
+          AGENT.disable!
+          logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
+        elsif CONFIG.disabled?
+          AGENT.disable!
+          logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
+        else
+          AGENT.enable!
+        end
+      end
+
       # This is where we process each request we intercept as a middleware. We make the request context
       # available globally so that it can be accessed from anywhere. A RequestHandler object is made
       # for each request, which handles prefilter and postfilter operations.
       def call_with_agent env
+        Contrast::Agent.thread_watcher.ensure_running?
+        return unless AGENT.enabled?
+
         framework_request = Contrast::Agent.framework_manager.retrieve_request(env)
         context = Contrast::Agent::RequestContext.new(framework_request)
         response = nil
@@ -155,7 +165,7 @@ module Contrast
         if exception.is_a?(Contrast::SecurityException) ||
               exception.message&.include?(SECURITY_EXCEPTION_MARKER)
 
-          exception_control = settings.exception_control
+          exception_control = AGENT.exception_control
           raise exception unless exception_control[:enable]
 
           [exception_control[:status], {}, [exception_control[:message]]]
@@ -164,24 +174,6 @@ module Contrast
           raise exception
         end
       end
-
-      def settings
-        Contrast::Agent::FeatureState.instance
-      end
-
-      # Rspec stubs over these methods for simplicity's sake in testing
-      def run_service_threads
-        Contrast::Utils::ServiceSenderUtil.start
-        Contrast::Agent::ServiceHeartbeat.new.start
-      end
-
-      # All this method chain does anymore is load the Thread patch that
-      # propagates request contexts.  That can go away RUBY-700.
-      SHARED_LIBRARIES = %w[contrast/extensions/ruby_core/thread].cs__freeze
-      def instrument_and_patch
-        SHARED_LIBRARIES.each { |lib| settings.instrument(lib) }
-        Contrast::Agent::Patching::Policy::Patcher.patch
-      end
     end
   end
 end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,6 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/class_util'
 
 module Contrast
@@ -9,13 +11,16 @@ module Contrast
       module Policy
         # Used to handle tracking patches that need to apply special instrumentation when a module is loaded
         class AfterLoadPatch
-          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument
+          include Contrast::Components::Interface
+          access_component :scope
+          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
             @instrumentation_file_path = instrumentation_file_path
+            @instrumenting_module = instrumenting_module
           end
 
           def applied?
@@ -55,6 +60,10 @@ module Contrast
 
           def instrument!
             cs__scoped_require instrumentation_file_path
+            if instrumenting_module
+              mod = Module.cs__const_get(instrumenting_module)
+              with_contrast_scope { mod.instrument } if mod
+            end
             @applied = true
           end
 

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -3,6 +3,7 @@
 
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+cs__scoped_require 'contrast/framework/manager'
 
 module Contrast
   module Agent
@@ -14,84 +15,78 @@ module Contrast
           include Contrast::Components::Interface
           access_component :agent, :logging
 
-          AFTER_LOAD_PATCHES = Set.new([
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_time_zone_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Railties::Helper::ClassMethods',
-                                             'contrast/extensions/framework/rails/action_controller_railties_helper_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::Scoping::Named::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_named'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::Read::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Sinatra::Base',
-                                             'contrast/extensions/framework/sinatra/base'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rails::Application::Configuration',
-                                             'contrast/extensions/framework/rails/configuration',
-                                             method_to_instrument: :session_store),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Request',
-                                             'contrast/extensions/framework/rack/request'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Response',
-                                             'contrast/extensions/framework/rack/response'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Live::Buffer',
-                                             'contrast/extensions/framework/rails/buffer'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Session::Cookie',
-                                             'contrast/extensions/framework/rack/cookie')
-                                       ])
-
           # After initialization run a catchup check to instrument any already loaded modules we care about
           def catchup_after_load_patches
+            apply_require_patches!
             apply_direct_patches!
-            applied = []
-            AFTER_LOAD_PATCHES.each do |after_load_patch|
-              next unless after_load_patch.target_defined?
-              next if AGENT.skip_instrumentation?(after_load_patch.module_name)
-
-              logger.trace(
-                  'Catching up on already loaded afterload patch - applying instrumentation',
-                  module: after_load_patch.module_name)
-              after_load_patch.instrument!
-              applied << after_load_patch
-            end
-            AFTER_LOAD_PATCHES.subtract(applied)
+            apply_load_patches!
           end
 
+          private
+
           # These patches need to be applied directly, not from our policy, so
           # do so and do so only once. This should be the new standard so that
           # there are no require time side effects of loading our core
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-                                    Contrast::CoreExtensions::Assess::FiberPropagator.instrument_fiber_track
-                                    Contrast::CoreExtensions::Assess::HashPropagator.instrument_hash_track
-                                    Contrast::CoreExtensions::Assess::RegexpPropagator.instrument_regexp_track
-                                    Contrast::CoreExtensions::Assess::StringPropagator.instrument_string
-                                    Contrast::CoreExtensions::Assess::StringPropagator.instrument_string_interpolation
+                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+                                    Contrast::Extension::Assess::StringPropagator.instrument_string
+                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+
+                                    Contrast::Extension::Protect::Kernel.instrument
                                     true
                                   end
           end
 
+          def apply_load_patches!
+            after_load_patches.each do |after_load_patch|
+              next unless after_load_patch.target_defined?
+              next if AGENT.skip_instrumentation?(after_load_patch.module_name)
+
+              logger.trace(
+                  'Catching up on already loaded afterload patch - applying instrumentation',
+                  module: after_load_patch.module_name)
+              after_load_patch.instrument!
+            end
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # These patches need to be applied directly, not from our policy, and
+          # are applied as a result of requiring the file as they alias methods
+          # directly, allowing us to control things like scope and exception
+          # handling
+          def apply_require_patches!
+            @_apply_require_patches ||= begin
+                                          cs__scoped_require 'contrast/extension/thread'
+                                          cs__scoped_require 'contrast/extension/kernel'
+                                          true
+                                        rescue LoadError, StandardError => e
+                                          logger.error('failed instrumenting apply_require_patches!', e)
+                                          false
+                                        end
+          end
+
+          def after_load_patches
+            @_after_load_patches ||= Contrast::Agent.framework_manager.find_after_load_patches
+          end
+
           # Use for any checks after we've initialized
           def load_patches_for_module module_name
-            return if AFTER_LOAD_PATCHES.empty?
+            return if after_load_patches.empty?
 
-            patch = AFTER_LOAD_PATCHES.find { |after_load_patch| after_load_patch.applies?(module_name) }
+            patch = after_load_patches.find { |after_load_patch| after_load_patch.applies?(module_name) }
             return unless patch
 
             logger.trace('Detected loading of afterload patch - applying instrumentation', module: module_name)
             patch.instrument!
-            AFTER_LOAD_PATCHES.subtract([patch]) if patch.applied?
+            after_load_patches.delete_if(&:applied?)
           end
         end
       end