contrast-agent 3.12.2 → 3.13.0

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -1,8 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/service_sender_util'
-
 module Contrast
   module Framework
     module Rails
@@ -15,7 +13,7 @@ module Contrast
               return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
 
               [context.server_activity, context.activity, context.observed_route].each do |msg|
-                Contrast::Utils::ServiceSenderUtil.send_event_immediately(msg)
+                Contrast::Agent.messaging_queue.send_event_immediately(msg)
               end
             end
 

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -23,7 +23,6 @@ module Contrast
             include Contrast::Utils::InvalidConfigurationUtil
 
             def analyze_session_store *args
-              return unless AGENT.enabled?
               return if PROTECT.enabled?
 
               apply_httponly_disabled(*args)
@@ -54,7 +53,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin
@@ -70,7 +69,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin
@@ -86,7 +85,7 @@ module Contrast
 
               rails_session_settings = args[1]
               with_contrast_scope do
-                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
               end
             rescue StandardError => e
               begin

data/lib/contrast/framework/rails/support.rb

@@ -1,10 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm_pb'
+cs__scoped_require 'contrast/api/dtm.pb'
 cs__scoped_require 'contrast/framework/base_support'
 cs__scoped_require 'contrast/framework/rails/patch/support'
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
 cs__scoped_require 'contrast/utils/string_utils'
 
 module Contrast
@@ -15,15 +14,6 @@ module Contrast
         extend Contrast::Framework::Rails::Patch::Support
 
         class << self
-          RAILS_VIEWS = [
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
-            Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-          ].cs__freeze
-
           RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
 
           def detection_class
@@ -51,13 +41,9 @@ module Contrast
             'rails'
           end
 
-          def scan_views
-            scan_view_directories(RAILS_VIEWS)
-          end
-
           def collect_routes
             routes = ::Rails.application.routes.routes.map do |route|
-              route_to_coverage(route)
+              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
             end
             routes
           end
@@ -79,7 +65,7 @@ module Contrast
             route = full_route[2] # route w/ highest precedence
             return unless route
 
-            route_to_coverage(route)
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
           end
 
           def retrieve_request env
@@ -93,21 +79,6 @@ module Contrast
 
             env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
           end
-
-          private
-
-          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-          def route_to_coverage route
-            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-            route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
-
-            verb = source_or_string(route.verb)
-            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
-
-            url = source_or_string(route.path.spec)
-            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
-            route_coverage
-          end
         end
       end
     end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -70,7 +70,7 @@ module Contrast
               routes.each do |pattern, _, _| # Mustermann::Sinatra
                 next unless pattern.params(route)
 
-                dtm = Contrast::Framework::Sinatra::Support.send(:route_to_coverage, clazz, method, pattern)
+                dtm = Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, pattern)
                 context.append_route_coverage(dtm)
                 break
               end

data/lib/contrast/framework/sinatra/support.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/sinatra/application_helper'
 cs__scoped_require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
@@ -10,7 +9,6 @@ module Contrast
     module Sinatra
       # Used when Sinatra is present to define framework specific behavior
       class Support < BaseSupport
-        extend Contrast::Framework::Sinatra::ApplicationHelper
         extend Contrast::Framework::Sinatra::Patch::Support
         class << self
           def detection_class
@@ -37,12 +35,6 @@ module Contrast
             'sinatra'
           end
 
-          def scan_views
-            return unless app_class
-
-            scan_view_directories(scannable_view_dirs)
-          end
-
           # Iterate over every class that extends Sinatra::Base, pull out its routes
           # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
           # Contrast::Api::Dtm::RouteCoverage
@@ -56,7 +48,7 @@ module Contrast
               class_routes.each_pair do |method, list|
                 # item: [ Mustermann::Sinatra, [], Proc]
                 list.each do |item|
-                  routes << route_to_coverage(clazz, method, item[0])
+                  routes << Contrast::Api::Dtm::RouteCoverage.from_sinatra_route(clazz, method, item[0])
                 end
               end
             end
@@ -74,6 +66,16 @@ module Contrast
 
           private
 
+          def app_class
+            return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            @_app_class ||= begin
+                              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+                              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+                              result_layer
+                            end
+          end
+
           # Iterate over every class that extends Sinatra::Base, pull out its routes
           # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
           # Contrast::Api::Dtm::RouteCoverage
@@ -89,19 +91,6 @@ module Contrast
             logger.trace('Sinatra controller found with no route instances', module: controller)
             nil
           end
-
-          # TODO: RUBY-763
-          # given clazz, method, and Mustermann::Sinatra, build a
-          # Contrast::Api::Dtm::RouteCoverage
-          def route_to_coverage clazz, method, pattern
-            safe_pattern = source_or_string(pattern)
-
-            route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-            route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
-            route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
-            route_coverage
-          end
         end
       end
     end

data/lib/contrast/funchook/funchook.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+# This module is used to find funchook library and determine availability
+module Funchook
+  include Contrast::Components::Interface
+  access_component :logging
+  attr_accessor :path
+
+  # Possible platform library files
+  ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
+
+  # Top level agent directories that should have the funchook libraries
+  SEARCH_DIRS = [
+    File.join('ext'),
+    File.join('shared_libraries'),
+    File.join('funchook', 'src')
+  ].cs__freeze
+
+  AGENT_ROOT = File.join(__dir__, '..', '..', '..')
+
+  def self.resolve_path!
+    actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+      load_path = absolute_path(potential_funchook_path)
+      File.exist?(load_path)
+    end
+
+    if actual_path_segments.nil?
+      logger.warn('Unable to find funchook')
+    else
+      @path = absolute_path(actual_path_segments)
+      logger.info('Funchook found', path: @path)
+    end
+    @path
+  end
+
+  def self.absolute_path path_array
+    File.absolute_path(File.join(AGENT_ROOT, *path_array))
+  end
+
+  def self.available?
+    @_available ||= !!resolve_path!
+  end
+end

data/lib/contrast/logger/application.rb

@@ -35,7 +35,7 @@ module Contrast
 
         loggable = CONFIG.raw.send(:load_config)
         loggable.delete('api')
-        info('Current configuration', configruation: JSON.pretty_generate(loggable))
+        info('Current configuration', configuration: JSON.pretty_generate(loggable))
       end
 
       def application_libraries

data/lib/contrast/logger/format.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'ougai'
+cs__scoped_require 'contrast/utils/thread_tracker'
+
+module Contrast
+  module Logger
+    # Our format for the Ougai logger allowing for custom log format that
+    # extends the behavior of the default Ougai logger
+    class Format < Ougai::Formatters::Bunyan
+      LOG_TRACKER = Contrast::Utils::ThreadTracker.new
+      # Our override of the _call method to add in the extra data that we want,
+      # based on
+      # https://github.com/tilfin/ougai/blob/1fe4fc2587be8eabc47d36dc57ee2814f8a0162b/lib/ougai/formatters/bunyan.rb#L26
+      # By default, it adds:
+      #   name: progname || @app_name,
+      #   hostname: @hostname,
+      #   pid: $$,
+      #   level: to_level(severity),
+      #   time: time,
+      #   v: 0
+      # and we add the fields from #format_hash
+      def _call severity, time, progname, data
+        super(severity,
+              time,
+              progname,
+              format_hash.merge(data)
+        )
+      end
+
+      private
+
+      # The extra values to add to the Bunyan hash. Because this is unique per
+      # thread, we'll create it once and then store it, rather than create a
+      # new hash on every log call.
+      # @return [Hash{Symbol => Object}] the extra data to log
+      #   tid: current thread id
+      def format_hash
+        hash = LOG_TRACKER.get(:thread_id_hash)
+        unless hash
+          hash = {
+              tid: Thread.current.object_id
+          }
+          LOG_TRACKER.set(:thread_id_hash, hash)
+        end
+        hash
+      end
+    end
+  end
+end

data/lib/contrast/logger/log.rb

@@ -8,6 +8,7 @@ cs__scoped_require 'singleton'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/logger/application'
+cs__scoped_require 'contrast/logger/format'
 cs__scoped_require 'contrast/logger/time'
 
 module Contrast
@@ -90,6 +91,7 @@ module Contrast
         add_contrast_loggers(logger)
         logger.progname = 'Contrast Agent'
         logger.level = level_const
+        logger.formatter = Contrast::Logger::Format.new
         logger.formatter.datetime_format = '%Y-%m-%dT%H:%M:%S.%L%z'
         logger
       end
@@ -108,10 +110,14 @@ module Contrast
         if write_permission?(path)
           path
         elsif write_permission?(DEFAULT_NAME)
-          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead."
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to default log '#{ DEFAULT_NAME }' instead." if previous_path != DEFAULT_NAME
           DEFAULT_NAME
         else
-          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead."
+          # Log once when the path is invalid. We'll change to this path, so no
+          # need to log again.
+          puts "[!] Unable to write to '#{ path }'. Writing to standard out instead." if previous_path != STDOUT_STR
           STDOUT_STR
         end
       end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -12,30 +12,55 @@ module Contrast
 
         access_component :logging
 
-        def self.tracked? obj
-          return false if obj.nil?
+        class << self
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def tracked? obj
+            _tracked?(obj, 0)
+          end
 
-          if Contrast::Utils::DuckUtils.iterable_hash?(obj)
-            obj.each_pair do |k, v|
-              return true if tracked?(k)
-              return true if tracked?(v)
-            end
-            false
-          elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
-            obj.any? do |ele|
-              tracked?(ele) unless obj == ele
+          private
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def _tracked? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _tracked?(k, idx)
+                return true if _tracked?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _tracked?(ele, idx) unless obj == ele
+              end
+            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
+              obj.cs__tracked?
+            else
+              false
             end
-          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-            obj.cs__tracked?
-          else
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
-        rescue StandardError => e
-          # This is used to ask if a ton of objects are tracked. They may not
-          # all be iterable. Bad things could happen in some cases, like when
-          # checking a closed statement for SQL injection trigger events
-          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
-          false
         end
       end
     end

data/lib/contrast/utils/hash_digest.rb

@@ -32,8 +32,8 @@ module Contrast
           request.parameters.each_key do |name|
             hash.update(name)
           end
-          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
-          hash.update(request.normalized_length_header(cl)) if cl
+          cl = request.headers[CONTENT_LENGTH_HEADER]
+          hash.update_on_content_length(cl) if cl
           hash.finish
         end
 
@@ -121,6 +121,15 @@ module Contrast
         end
       end
 
+      CHARS = %w[a b c d e f g].cs__freeze
+      # This method converts and integer value for length into a string value
+      # that we can hash on, based on the logarithmic value of the length, and
+      # updates the current hash with that value.
+      # @param chr [Numeric] the length to translate
+      def update_on_content_length chr
+        update(CHARS[Math.log10(chr.to_s.length).to_i] || CHARS[-1])
+      end
+
       def initialize
         @crc32 = 0
       end