contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/logger/log.rb

@@ -1,14 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'logger'
-cs__scoped_require 'ougai'
-cs__scoped_require 'singleton'
+require 'logger'
+require 'ougai'
+require 'singleton'
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/logger/application'
-cs__scoped_require 'contrast/logger/time'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
+require 'contrast/logger/application'
+require 'contrast/logger/format'
+require 'contrast/logger/request'
+require 'contrast/logger/time'
 
 module Contrast
   module Logger
@@ -90,12 +92,14 @@ module Contrast
         add_contrast_loggers(logger)
         logger.progname = 'Contrast Agent'
         logger.level = level_const
+        logger.formatter = Contrast::Logger::Format.new
         logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
         logger
       end
 
       def add_contrast_loggers logger
         logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Request)
         logger.extend(Contrast::Logger::Time)
       end
 
@@ -108,10 +112,14 @@ module Contrast
         if write_permission?(path)
           path
         elsif write_permission?(DEFAULT_NAME)
-          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
           DEFAULT_NAME
         else
-          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead."
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead." if previous_path != STDOUT_STR
           STDOUT_STR
         end
       end

data/lib/contrast/logger/request.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for the logging of the
+    # request lifecycle, used to provide context during troubleshooting.
+    module Request
+      include Contrast::Components::Interface
+      access_component :config
+
+      # Utility method to log the start of a request
+      def request_start
+        debug('Beginning request analysis')
+      end
+
+      # Utility method to log the end of a request, including the time it took
+      # for that request to be processed.
+      def request_end
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        elapsed_time = context ? (Contrast::Utils::Timer.now_ms - context.timer.start_ms) : -1
+        debug('Ending request analysis',
+              elapsed_time_ms: elapsed_time)
+      end
+    end
+  end
+end

data/lib/contrast/tasks/config.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'yaml'
+require 'yaml'
 
 module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings

data/lib/contrast/tasks/service.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/os'
+require 'contrast/components/interface'
+require 'contrast/utils/os'
 
 module Contrast
   # A Rake task designed to allow control of the Contrast Service as a stand

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'singleton'
-cs__scoped_require 'contrast/components/interface'
+require 'singleton'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils
@@ -12,30 +12,55 @@ module Contrast
 
         access_component :logging
 
-        def self.tracked? obj
-          return false if obj.nil?
+        class << self
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def tracked? obj
+            _tracked?(obj, 0)
+          end
 
-          if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-            obj.each_pair do |k, v|
-              return true if tracked?(k)
-              return true if tracked?(v)
-            end
-            false
-          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-            obj.any? do |ele|
-              tracked?(ele) unless obj == ele
+          private
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def _tracked? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _tracked?(k, idx)
+                return true if _tracked?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _tracked?(ele, idx) unless obj == ele
+              end
+            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
+              obj.cs__tracked?
+            else
+              false
             end
-          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-            obj.cs__tracked?
-          else
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
-        rescue StandardError => e
-          # This is used to ask if a ton of objects are tracked. They may not
-          # all be iterable. Bad things could happen in some cases, like when
-          # checking a closed statement for SQL injection trigger events
-          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
-          false
         end
       end
     end

data/lib/contrast/utils/boolean_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Utils

data/lib/contrast/utils/class_util.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/extension/module'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
@@ -56,7 +56,9 @@ module Contrast
         # @return [String] the human readable form of the String, as defined by
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
-          if object.cs__is_a?(String)
+          # Only treat object like a string if it actually is a string
+          # some subclasses of String override string methods we depend on
+          if object.cs__class == String
             cached = to_cached_string(object)
             return cached if cached
 

data/lib/contrast/utils/freeze_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/duck_utils'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Utils

data/lib/contrast/utils/gemfile_reader.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/api'
+require 'set'
+require 'contrast/utils/sha256_builder'
+require 'contrast/utils/string_utils'
+require 'contrast/components/interface'
+require 'contrast/api'
 
 module Contrast
   module Utils

data/lib/contrast/utils/hash_digest.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'digest'
+require 'digest'
 
 module Contrast
   module Utils
@@ -32,8 +32,8 @@ module Contrast
           request.parameters.each_key do |name|
             hash.update(name)
           end
-          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
-          hash.update(request.normalized_length_header(cl)) if cl
+          cl = request.headers[CONTENT_LENGTH_HEADER]
+          hash.update_on_content_length(cl) if cl
           hash.finish
         end
 
@@ -121,7 +121,17 @@ module Contrast
         end
       end
 
+      CHARS = %w[a b c d e f g].cs__freeze
+      # This method converts and integer value for length into a string value
+      # that we can hash on, based on the logarithmic value of the length, and
+      # updates the current hash with that value.
+      # @param chr [Numeric] the length to translate
+      def update_on_content_length chr
+        update(CHARS[Math.log10(chr.to_s.length).to_i] || CHARS[-1])
+      end
+
       def initialize
+        super
         @crc32 = 0
       end
 

data/lib/contrast/utils/heap_dump_util.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'objspace'
-cs__scoped_require 'contrast/components/interface'
+require 'objspace'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils
@@ -44,29 +44,13 @@ module Contrast
         activity = Contrast::Api::Dtm::Activity.new
         activity.findings << finding
 
-        # If assess is enabled, we can just send the activity
-        if APP_CONTEXT.ready?
-          build_tags(activity)
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
-        # Otherwise, if the Agent isn't ready, we have to queue the messages
-        # until we know the starting state.
-        else
-          Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
-        end
+        Contrast::Agent.messaging_queue.send_event_eventually(activity)
       rescue StandardError => e
         logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private
 
-      # This seems silly to pull out, but we can ONLY call this in the case
-      # where we have a configuration. Doing otherwise results in a bad error
-      # case where we try to do other things, like logging, which behave
-      # strangely without a config
-      def build_tags activity
-        activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-      end
-
       def file_snippet file_path, call_location
         idx = call_location&.lineno
         if file_path && idx && File.exist?(file_path)

data/lib/contrast/utils/inventory_util.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/timer'
+require 'contrast/utils/object_share'
+require 'contrast/utils/gemfile_reader'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils
@@ -18,11 +18,10 @@ module Contrast
       AC_TYPE_DB = 'db'
       # TeamServer only accepts certain values for FlowMap Services.
       # DO NOT CHANGE THIS
-      DATABASE = 'Database'
       ADAPTER = 'adapter'
       HOST = 'host'
       PORT = 'port'
-      DATABASE_LOWER = 'database'
+      DATABASE = 'database'
       DEFAULT = 'default'
       LOCALHOST = 'localhost'
 
@@ -42,7 +41,6 @@ module Contrast
         arr = build_from_db_config(hash_or_str)
         return unless arr&.any?
 
-        activity_or_update.technologies[DATABASE] = true
         arr.each do |a|
           next unless a
 
@@ -51,9 +49,6 @@ module Contrast
           else
             activity_or_update.components << a
           end
-          next if a.vendor.empty?
-
-          activity_or_update.technologies[a.vendor] = true
         end
       rescue StandardError => e
         logger.error('Unable to append db config', e)
@@ -76,7 +71,7 @@ module Contrast
         ac.remote_host = host_from_hash(hash)
         ac.remote_port = port_from_hash(hash)
         ac.type = AC_TYPE_DB
-        ac.url = hash[:database] || hash[DATABASE_LOWER] || DEFAULT
+        ac.url = hash[:database] || hash[DATABASE] || DEFAULT
         [ac]
       end
 

data/lib/contrast/utils/io_util.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils

data/lib/contrast/utils/object_share.rb

@@ -30,7 +30,6 @@ module Contrast
       SEMICOLON =     ';'
       SINGLE_QUOTE =  '\''
       SLASH =         '/'
-      SPACE =         ' '
       UNDERSCORE =    '_'
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'

data/lib/contrast/utils/os.rb

@@ -1,23 +1,35 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/interface'
+
 module Contrast
   module Utils
     # Simple utility used to make OS calls and determine state. For that state
     # which will not change at runtime, such as the operating system, the
     # Utility memozies to avoid multiple lookups.
     module OS
+      include Contrast::Components::Interface
+      access_component :scope
+
       class << self
         def running?
-          process = `ps aux | grep contrast-servic[e]`
-          process != ''
+          result = false
+          with_contrast_scope do
+            process = `ps aux | grep contrast-servic[e]`
+            processes = process.split("\n")
+            result = !processes.empty? && processes.any? { |process_descriptor| !process_descriptor.include?('grep') }
+          end
+          result
         end
 
         # check if service was killed and is a zombie process
         # returns an array of zombie process PIDs as strings; empty array if there are none
         def zombie_pids
-          zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
-          zombie_pid_list.split("\n")
+          with_contrast_scope do
+            zombie_pid_list = `ps aux | grep contrast-servic[e] | grep Z | awk '{print $2}'` # retrieve pid of service processes
+            zombie_pid_list.split("\n")
+          end
         end
       end
     end