contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/framework/sinatra/application_helper.rb

@@ -1,51 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    module Sinatra
-      # This module is to help perform sometimes necessary tasks specific to Sinatra
-      module ApplicationHelper
-        SINATRA_VIEWS = [
-          Contrast::Framework::ViewTechnologiesDescriptor.new('public/stylesheets', 'scss', %w[SASS]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html', %w[HTML5]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.erb', %w[HTML5 ERB]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.haml', %w[HTML5 HAML]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-        ].cs__freeze
-
-        def app_class
-          @_app_class ||= begin
-                            return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
-
-                            sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
-                            result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-                            result_layer
-                          end
-        end
-
-        def scannable_view_dirs
-          @_scannable_view_dirs ||= begin
-                                      views = SINATRA_VIEWS.dup
-                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'erb', %w[HTML5 ERB]) if view_directory
-                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'haml', %w[HTML5 HAML]) if view_directory
-                                      views << Contrast::Framework::ViewTechnologiesDescriptor.new(public_directory, 'html', %w[HTML5]) if public_directory
-                                      views
-                                    end
-        end
-
-        def view_directory
-          @_view_directory ||= begin
-                                 app_class&.settings&.views
-                               end
-        end
-
-        def public_directory
-          @_public_directory ||= begin
-                                   app_class&.settings&.public_dir
-                                 end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -1,21 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # Used to define common locations and extensions for specific technologies
-    class ViewTechnologiesDescriptor
-      attr_reader :path, :extension, :technology_names
-
-      def initialize path, extension, technology_names
-        @path = path
-        @extension = extension
-        @technology_names = technology_names
-      end
-
-      def empty?
-        Dir["#{ path }/**/*#{ extension }"].empty?
-      end
-    end
-  end
-end

data/lib/contrast/internal_exception.rb

@@ -1,8 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  # Used to type a StandardError raised by Contrast code.
-  class InternalException < StandardError
-  end
-end

data/lib/contrast/utils/cache.rb

@@ -1,58 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Implementation taken from http://stackoverflow.com/questions/1933866/efficient-ruby-lru-cache
-    class Cache
-      def initialize max_size = 1000
-        @max_size = max_size
-        @data = {}
-      end
-
-      def [] key
-        found = true
-        value = @data.delete(key) { found = false }
-        @data[key] = value if found
-      end
-
-      def []= key, value
-        @data.delete(key)
-        @data[key] = value
-        @data.delete(@data.first[0]) if @data.length > @max_size
-
-        value # rubocop:disable Lint/Void
-      end
-
-      def each
-        @data.reverse_each do |pair|
-          yield pair
-        end
-      end
-
-      # used further up the chain, non thread safe each
-      alias_method :each_unsafe, :each
-
-      def to_a
-        @data.to_a.reverse
-      end
-
-      def delete key
-        @data.delete(key)
-      end
-
-      def clear
-        @data.clear
-      end
-
-      def count
-        @data.count
-      end
-
-      # for cache validation only, ensures all is sound
-      def valid?
-        true
-      end
-    end
-  end
-end

data/lib/contrast/utils/service_sender_util.rb

@@ -1,167 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module keeps a background thread, initialized at startup, running. This thread is
-    # responsible for pulling a message off the queue, sending that message to SpeedRacer, and
-    # processing the response returned back from SpeedRacer. When we didn't know our config
-    # values, we may have queued assess messages to send later. This thread is also
-    # responsible for checking to see if we are now ready to send any of these assess messages
-    # to SpeedRacer.
-    module ServiceSenderUtil
-      include Contrast::Components::Interface
-      access_component :analysis, :app_context, :logging, :settings
-
-      class << self
-        # Push the given DTM into a queue to be sent to the Service.
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
-        #   Contrast::Api::Dtm::Message
-        def push_to_ready_queue event
-          return unless event
-
-          prep_queue
-          ready_messages_queue.push event
-          logger.debug('Enqueued event',
-                       event_id: event.__id__,
-                       event_type: event.cs__class.name,
-                       queue: ready_messages_queue.__id__,
-                       length: ready_messages_queue.length)
-        end
-
-        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
-        # to receive the response object back from SpeedRacer. An invoking method that needs
-        # to process the response object with custom logic should use this method.
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
-        #   field of Contrast::Api::Dtm::Message
-        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
-        def send_event_immediately event
-          client.send_to_speedracer(event) if event
-        end
-
-        def sending_thread
-          return @_sender_thread if @_sender_thread
-
-          # in case we got here before a message attempted to be sent, let's make sure these are initialized
-          @_sender_thread ||= Contrast::Agent::Thread.new do
-            loop do
-              check_assess_queue
-              # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
-              event = ready_messages_queue.pop
-              begin
-                logger.debug('Dequeued event',
-                             event_id: event.__id__,
-                             event_type: event.cs__class.name,
-                             queue: ready_messages_queue.__id__,
-                             length: ready_messages_queue.length)
-                response = client.send_to_speedracer(event)
-                Contrast::Utils::ServiceResponseUtil.process_response(response) if response
-              rescue StandardError => e
-                logger.error('Could not send message to service from service sender thread.', e)
-              end
-            end
-          end
-          logger.debug('Started background sending thread.')
-        end
-        alias_method :start, :sending_thread
-
-        def stop
-          Thread.kill(@_sender_thread) if @_sender_thread&.alive?
-        end
-
-        def add_to_assess_messages msg
-          assess_messages! << msg
-        end
-
-        # Return true if the agent has connected with the service
-        def connection_established?
-          client.connection_established?
-        end
-
-        private
-
-        # TODO: RUBY-920
-        # If we've been forked, then we need to make sure the sender is set and
-        # alive. This is a temporary workaround to address issues in Passenger
-        # around forking and will be addressed next sprint.
-        def prep_queue
-          return if @_sender_thread&.alive?
-
-          @_sender_thread = nil
-          start
-        end
-
-        def ready_messages_queue
-          @_ready_messages_queue ||= begin
-                                       tmp = Queue.new
-                                       logger.debug('Creating new ready_messages_queue.',
-                                                    queue: tmp.__id__,
-                                                    length: tmp.length)
-                                       tmp
-                                     end
-        end
-
-        def assess_messages!
-          unless @_assess_messages
-            logger.debug('Creating new assess messages queue by force.')
-            @_assess_messages = nil
-          end
-          assess_messages
-        end
-
-        # This list holds messages containing assess findings. We may not
-        # know if the agent is running in assess, so until we do then we
-        # must keep the messages stored here. Once we do know, we'll set this
-        # to `false` and rely on the standard ready_messages_queue
-        def assess_messages
-          if @_assess_messages.nil?
-            logger.debug('Creating new assess messages queue.')
-            @_assess_messages = []
-          end
-          @_assess_messages
-        end
-
-        def client
-          @_client ||= Contrast::Agent::SocketClient.new
-        end
-
-        def check_assess_queue
-          return unless assess_messages
-          return unless APP_CONTEXT.ready?
-
-          if ASSESS.enabled?
-            assess_messages.each do |msg|
-              update_queued_finding msg
-              ready_messages_queue.push msg # this message is ready to be sent to SR
-            end
-          end
-          @_assess_messages = false # clear out queue, we no longer need it
-        end
-
-        # When we queued up findings, we didn't have access to a configuration
-        # object. As such, we have to make decisions now for those findings.
-        def update_queued_finding msg
-          # Findings only exist in activity messages
-          return unless msg.is_a?(Contrast::Api::Dtm::Activity)
-
-          # So set their tags
-          msg.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-
-          # and see if they're even enabled
-          check = msg.findings.dup
-          check.each do |finding|
-            msg.findings.delete(finding) if ASSESS.rule_disabled?(finding.rule_id)
-          end
-
-          msg.findings.each do |finding|
-            finding.session_id = SETTINGS.session_id
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/sinatra_helper.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # This module is to help perform sometimes necessary tasks specific to Sinatra
-    module SinatraHelper
-      SINATRA_VIEWS = [
-        ['public/stylesheets', '*.scss', %w[SASS]],
-        ['views', '*.html', %w[HTML5]],
-        ['views', '*.html.erb', %w[HTML5 ERB]],
-        ['views', '*.html.haml', %w[HTML5 HAML]],
-        ['public', '*.html', %w[HTML5]]
-      ].cs__freeze
-
-      def self.app_class
-        @_app_class ||= begin
-          return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-          sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
-          result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-          result_layer
-        end
-      end
-
-      def self.scannable_view_dirs
-        @_scannable_view_dirs ||= begin
-          views = SINATRA_VIEWS.dup
-          views << [view_directory, '*.erb', %w[HTML5 ERB]] if view_directory
-          views << [view_directory, '*.haml', %w[HTML5 HAML]] if view_directory
-          views << [public_directory, '*.html', %w[HTML5]] if public_directory
-          views
-        end
-      end
-
-      def self.view_directory
-        @_view_directory ||= begin
-          app_class&.settings&.views
-        end
-      end
-
-      def self.public_directory
-        @_public_directory ||= begin
-          app_class&.settings&.public_dir
-        end
-      end
-    end
-  end
-end