contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/components/interface'
+require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
   module Framework
@@ -23,7 +23,6 @@ module Contrast
             include Contrast::Utils::InvalidConfigurationUtil
 
             def analyze_session_store *args
-              return unless AGENT.enabled?
               return if PROTECT.enabled?
 
               apply_httponly_disabled(*args)
@@ -54,7 +53,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin
@@ -70,7 +69,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin
@@ -86,7 +85,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+require 'contrast/framework/rails/patch/assess_configuration'
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework
@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -17,9 +17,9 @@ module Contrast
             @_instrument ||= begin
                                ::ActionController::Railties::Helpers.class_eval do
                                  alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass
+                                 def inherited klass # rubocop:disable Lint/MissingSuper
                                    klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass)
+                                   cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
                                  ensure
                                    klass&.instance_variable_set(:@cs__defining_class, false)
                                  end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -58,7 +58,7 @@ module Contrast
 
             def instrument
               @_instrument_named_track ||= begin
-                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                                                 require 'cs__assess_active_record_named/cs__assess_active_record_named'
                                                  true
                                                end
             rescue StandardError, LoadError => e

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -16,9 +16,9 @@ module Contrast
                                  private
 
                                  alias_method :cs__patched_inherited, :inherited
-                                 def inherited klass
+                                 def inherited klass # rubocop:disable Lint/MissingSuper
                                    klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_inherited(klass)
+                                   cs__patched_inherited(klass) # This calls the original inherited, which should handle super as needed.
                                  ensure
                                    klass&.instance_variable_set(:@cs__defining_class, false)
                                  end

data/lib/contrast/framework/rails/support.rb

@@ -1,11 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm_pb'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails/patch/support'
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/api/dtm.pb'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rails/patch/support'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Framework
@@ -15,15 +14,6 @@ module Contrast
         extend Contrast::Framework::Rails::Patch::Support
 
         class << self
-          RAILS_VIEWS = [
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-          ].cs__freeze
-
           RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
 
           def detection_class
@@ -51,15 +41,8 @@ module Contrast
             'rails'
           end
 
-          def scan_views
-            scan_view_directories(RAILS_VIEWS)
-          end
-
           def collect_routes
-            routes = ::Rails.application.routes.routes.map do |route|
-              route_to_coverage(route)
-            end
-            routes
+            find_all_routes(::Rails.application, [])
           end
 
           def current_route request
@@ -73,13 +56,17 @@ module Contrast
             full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
             return if full_routes.empty?
 
-            full_route = full_routes[0] # [match_data, path_parameters, route]
-            return unless full_route
+            full_route = full_routes[0]
 
-            route = full_route[2] # route w/ highest precedence
-            return unless route
-
-            route_to_coverage(route)
+            # the route is directly implemented within the application
+            if direct_route?(full_route)
+              route = full_route[2] # route w/ highest precedence
+              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            else
+              engine_route(full_route, request)
+            end
+          rescue StandardError => _e
+            nil
           end
 
           def retrieve_request env
@@ -96,17 +83,49 @@ module Contrast
 
           private
 
-          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-          def route_to_coverage route
-            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-            route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
+          # route is not mounted within an engine
+          def direct_route? full_route
+            full_route[2]&.app&.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher ||
+                (full_route[2].cs__class == ActionDispatch::Journey::Route && full_route[2]&.app&.cs__class == ActionDispatch::Routing::Mapper::Constraints)
+          end
+
+          def engine_route full_route, request
+            engine_route = full_route[2] # supposed route - but actually an Engine mount point
+            return unless engine_route
 
-            verb = source_or_string(route.verb)
-            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+            engine_mount_name = engine_route.name
+            return unless engine_mount_name
 
-            url = source_or_string(route.path.spec)
-            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
-            route_coverage
+            engine_path_segments = request.rack_request.path_info.split(engine_mount_name)
+            return if engine_path_segments.empty?
+
+            path_within_engine = engine_path_segments[-1]
+            return unless path_within_engine
+
+            engine_router = engine_route.app&.app&.routes&.router
+            return unless engine_router
+
+            # Get all routes regardless of http method
+            matching_routes = engine_router.send(:filter_routes, path_within_engine)
+            return unless matching_routes
+
+            # filter for current http method
+            reportable_routes = engine_router.send(:match_routes, matching_routes, request.rack_request)
+            return if reportable_routes.empty?
+
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(reportable_routes[0])
+          end
+
+          # Rails engine routes need to be detected by inspecting Engine class route set
+          def find_all_routes app, route_list
+            app.routes.routes.each do |route|
+              if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
+                route_list << Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+              elsif route.app.app.cs__respond_to?(:routes)
+                route_list += find_all_routes(route.app.app, [])
+              end
+            end
+            route_list
           end
         end
       end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/sinatra/support'
+require 'contrast/framework/sinatra/support'
 
 module Contrast
   module Framework
@@ -70,7 +70,7 @@ module Contrast
               routes.each do |pattern, _, _| # Mustermann::Sinatra
                 next unless pattern.params(route)
 
-                dtm = Contrast::Framework::Sinatra::Support.send(:route_to_coverage, clazz, method, pattern)
+                dtm = Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, pattern)
                 context.append_route_coverage(dtm)
                 break
               end

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/sinatra/support.rb

@@ -1,16 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/sinatra/application_helper'
-cs__scoped_require 'contrast/framework/sinatra/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
   module Framework
     module Sinatra
       # Used when Sinatra is present to define framework specific behavior
       class Support < BaseSupport
-        extend Contrast::Framework::Sinatra::ApplicationHelper
         extend Contrast::Framework::Sinatra::Patch::Support
         class << self
           def detection_class
@@ -37,12 +35,6 @@ module Contrast
             'sinatra'
           end
 
-          def scan_views
-            return unless app_class
-
-            scan_view_directories(scannable_view_dirs)
-          end
-
           # Iterate over every class that extends Sinatra::Base, pull out its routes
           # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
           # Contrast::Api::Dtm::RouteCoverage
@@ -56,7 +48,7 @@ module Contrast
               class_routes.each_pair do |method, list|
                 # item: [ Mustermann::Sinatra, [], Proc]
                 list.each do |item|
-                  routes << route_to_coverage(clazz, method, item[0])
+                  routes << Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, item[0])
                 end
               end
             end
@@ -74,6 +66,16 @@ module Contrast
 
           private
 
+          def app_class
+            return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            @_app_class ||= begin
+                              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+                              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+                              result_layer
+                            end
+          end
+
           # Iterate over every class that extends Sinatra::Base, pull out its routes
           # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
           # Contrast::Api::Dtm::RouteCoverage
@@ -89,19 +91,6 @@ module Contrast
             logger.trace('Sinatra controller found with no route instances', module: controller)
             nil
           end
-
-          # TODO: RUBY-763
-          # given clazz, method, and Mustermann::Sinatra, build a
-          # Contrast::Api::Dtm::RouteCoverage
-          def route_to_coverage clazz, method, pattern
-            safe_pattern = source_or_string(pattern)
-
-            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-            route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
-            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
-            route_coverage
-          end
         end
       end
     end

data/lib/contrast/funchook/funchook.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+# This module is used to find funchook library and determine availability
+module Funchook
+  include Contrast::Components::Interface
+  access_component :logging
+  attr_accessor :path
+
+  # Possible platform library files
+  ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
+
+  # Top level agent directories that should have the funchook libraries
+  SEARCH_DIRS = [
+    File.join('ext'),
+    File.join('shared_libraries'),
+    File.join('funchook', 'src')
+  ].cs__freeze
+
+  AGENT_ROOT = File.join(__dir__, '..', '..', '..')
+
+  def self.resolve_path!
+    actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+      load_path = absolute_path(potential_funchook_path)
+      File.exist?(load_path)
+    end
+
+    if actual_path_segments.nil?
+      logger.warn('Unable to find funchook')
+    else
+      @path = absolute_path(actual_path_segments)
+      logger.info('Funchook found', path: @path)
+    end
+    @path
+  end
+
+  def self.absolute_path path_array
+    File.absolute_path(File.join(AGENT_ROOT, *path_array))
+  end
+
+  def self.available?
+    @_available ||= !!resolve_path!
+  end
+end

data/lib/contrast/logger/application.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Logger
-    # # Our decorator for the Ougai logger allowing for the logging of the
+    # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
       include Contrast::Components::Interface
@@ -35,7 +35,7 @@ module Contrast
 
         loggable = CONFIG.raw.send(:load_config)
         loggable.delete('api')
-        info('Current configuration', configruation: JSON.pretty_generate(loggable))
+        info('Current configuration', configuration: JSON.pretty_generate(loggable))
       end
 
       def application_libraries

data/lib/contrast/logger/format.rb

@@ -0,0 +1,64 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'ougai'
+require 'contrast/utils/object_share'
+require 'contrast/utils/thread_tracker'
+
+module Contrast
+  module Logger
+    # Our format for the Ougai logger allowing for custom log format that
+    # extends the behavior of the default Ougai logger
+    class Format < Ougai::Formatters::Bunyan
+      LOG_TRACKER = Contrast::Utils::ThreadTracker.new
+      # Our override of the _call method to add in the extra data that we want,
+      # based on
+      # https://github.com/tilfin/ougai/blob/1fe4fc2587be8eabc47d36dc57ee2814f8a0162b/lib/ougai/formatters/bunyan.rb#L26
+      # By default, it adds:
+      #   name: progname || @app_name,
+      #   hostname: @hostname,
+      #   pid: $$,
+      #   level: to_level(severity),
+      #   time: time,
+      #   v: 0
+      # and we add the fields from #format_hash
+      def _call severity, time, progname, data
+        super(severity,
+              time,
+              progname,
+              format_hash.merge(data)
+        )
+      end
+
+      private
+
+      # The extra values to add to the Bunyan hash.
+      # @return [Hash{Symbol => Object}] the extra data to log
+      def format_hash
+        thread_hash.merge(request_hash)
+      end
+
+      # Because this is unique per thread, we'll create it once and then store
+      # it, rather than create a new hash on every log call during the request.
+      def thread_hash
+        hash = LOG_TRACKER.get(:logging_hash)
+        unless hash
+          hash = {
+              thread_id: Thread.current.object_id
+          }
+          LOG_TRACKER.set(:logging_hash, hash)
+        end
+        hash
+      end
+
+      NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
+      def request_hash
+        @request_tracker_defined ||= defined?(Contrast::Agent) &&
+            defined?(Contrast::Agent::REQUEST_TRACKER)
+        return NO_REQUEST_HASH unless @request_tracker_defined
+
+        Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH
+      end
+    end
+  end
+end