contrast-agent 3.12.2 → 3.13.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (167) hide show
  1. checksums.yaml +4 -4
  2. data/.dockerignore +0 -1
  3. data/.gitignore +1 -1
  4. data/.simplecov +1 -1
  5. data/Rakefile +31 -0
  6. data/ext/build_funchook.rb +0 -2
  7. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -8
  8. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +0 -1
  9. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -6
  10. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -5
  11. data/ext/cs__assess_yield_track/cs__assess_yield_track.h +0 -1
  12. data/ext/cs__common/cs__common.c +24 -0
  13. data/ext/cs__common/cs__common.h +3 -0
  14. data/ext/cs__common/extconf.rb +0 -14
  15. data/ext/extconf_common.rb +0 -28
  16. data/lib/contrast.rb +3 -1
  17. data/lib/contrast/agent.rb +14 -2
  18. data/lib/contrast/agent/assess/contrast_event.rb +28 -167
  19. data/lib/contrast/agent/assess/events/source_event.rb +3 -7
  20. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  21. data/lib/contrast/agent/assess/policy/policy_node.rb +4 -98
  22. data/lib/contrast/agent/assess/policy/propagation_method.rb +1 -2
  23. data/lib/contrast/agent/assess/policy/propagation_node.rb +5 -1
  24. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  25. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -4
  26. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +9 -1
  27. data/lib/contrast/agent/assess/policy/propagator/remove.rb +6 -11
  28. data/lib/contrast/agent/assess/policy/propagator/select.rb +4 -4
  29. data/lib/contrast/agent/assess/policy/propagator/split.rb +2 -2
  30. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +4 -4
  31. data/lib/contrast/agent/assess/policy/propagator/trim.rb +6 -10
  32. data/lib/contrast/agent/assess/policy/source_method.rb +1 -2
  33. data/lib/contrast/agent/assess/policy/trigger_method.rb +1 -9
  34. data/lib/contrast/agent/assess/policy/trigger_node.rb +16 -4
  35. data/lib/contrast/agent/assess/properties.rb +4 -382
  36. data/lib/contrast/agent/assess/property/evented.rb +78 -0
  37. data/lib/contrast/agent/assess/property/tagged.rb +339 -0
  38. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -20
  39. data/lib/contrast/agent/assess/tag.rb +27 -12
  40. data/lib/contrast/agent/at_exit_hook.rb +3 -1
  41. data/lib/contrast/agent/exclusion_matcher.rb +2 -2
  42. data/lib/contrast/agent/inventory/policy/datastores.rb +0 -1
  43. data/lib/contrast/agent/middleware.rb +2 -14
  44. data/lib/contrast/agent/patching/policy/patch.rb +1 -1
  45. data/lib/contrast/agent/patching/policy/policy.rb +3 -3
  46. data/lib/contrast/agent/patching/policy/policy_node.rb +2 -2
  47. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  48. data/lib/contrast/agent/protect/rule/base.rb +19 -31
  49. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  50. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +2 -7
  51. data/lib/contrast/agent/protect/rule/xxe.rb +1 -0
  52. data/lib/contrast/agent/reaction_processor.rb +3 -3
  53. data/lib/contrast/agent/request.rb +92 -331
  54. data/lib/contrast/agent/request_context.rb +15 -15
  55. data/lib/contrast/agent/request_handler.rb +1 -1
  56. data/lib/contrast/agent/response.rb +2 -14
  57. data/lib/contrast/agent/scope.rb +1 -1
  58. data/lib/contrast/agent/service_heartbeat.rb +7 -9
  59. data/lib/contrast/agent/static_analysis.rb +1 -1
  60. data/lib/contrast/agent/thread_watcher.rb +49 -0
  61. data/lib/contrast/agent/version.rb +1 -1
  62. data/lib/contrast/agent/worker_thread.rb +24 -0
  63. data/lib/contrast/api.rb +3 -5
  64. data/lib/contrast/api/communication.rb +20 -0
  65. data/lib/contrast/api/communication/connection_status.rb +41 -0
  66. data/lib/contrast/api/communication/messaging_queue.rb +79 -0
  67. data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb} +9 -18
  68. data/lib/contrast/api/communication/service_lifecycle.rb +61 -0
  69. data/lib/contrast/api/communication/socket.rb +45 -0
  70. data/lib/contrast/api/communication/socket_client.rb +76 -0
  71. data/lib/contrast/api/communication/speedracer.rb +111 -0
  72. data/lib/contrast/api/communication/tcp_socket.rb +31 -0
  73. data/lib/contrast/api/communication/unix_socket.rb +27 -0
  74. data/lib/contrast/api/decorators.rb +10 -0
  75. data/lib/contrast/api/decorators/address.rb +60 -0
  76. data/lib/contrast/api/decorators/application_settings.rb +7 -3
  77. data/lib/contrast/api/decorators/application_update.rb +0 -9
  78. data/lib/contrast/api/decorators/http_request.rb +139 -0
  79. data/lib/contrast/api/decorators/message.rb +75 -0
  80. data/lib/contrast/api/decorators/rasp_rule_sample.rb +28 -0
  81. data/lib/contrast/api/decorators/route_coverage.rb +57 -0
  82. data/lib/contrast/api/decorators/trace_event.rb +99 -0
  83. data/lib/contrast/api/decorators/trace_event_object.rb +57 -0
  84. data/lib/contrast/api/decorators/trace_event_signature.rb +46 -0
  85. data/lib/contrast/api/decorators/trace_taint_range.rb +51 -0
  86. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +109 -0
  87. data/lib/contrast/api/decorators/user_input.rb +40 -0
  88. data/lib/contrast/components/app_context.rb +0 -7
  89. data/lib/contrast/components/config.rb +4 -9
  90. data/lib/contrast/components/interface.rb +1 -1
  91. data/lib/contrast/components/settings.rb +0 -6
  92. data/lib/contrast/extension/assess.rb +0 -1
  93. data/lib/contrast/extension/assess/assess_extension.rb +1 -2
  94. data/lib/contrast/extension/assess/fiber.rb +1 -1
  95. data/lib/contrast/extension/assess/string.rb +1 -1
  96. data/lib/contrast/extension/inventory.rb +0 -1
  97. data/lib/contrast/framework/base_support.rb +0 -23
  98. data/lib/contrast/framework/manager.rb +0 -9
  99. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -3
  100. data/lib/contrast/framework/rails/patch/assess_configuration.rb +3 -4
  101. data/lib/contrast/framework/rails/support.rb +3 -32
  102. data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
  103. data/lib/contrast/framework/sinatra/support.rb +11 -22
  104. data/lib/contrast/funchook/funchook.rb +45 -0
  105. data/lib/contrast/logger/application.rb +1 -1
  106. data/lib/contrast/logger/format.rb +51 -0
  107. data/lib/contrast/logger/log.rb +8 -2
  108. data/lib/contrast/utils/assess/tracking_util.rb +45 -20
  109. data/lib/contrast/utils/hash_digest.rb +11 -2
  110. data/lib/contrast/utils/invalid_configuration_util.rb +1 -17
  111. data/lib/contrast/utils/inventory_util.rb +2 -7
  112. data/lib/contrast/utils/object_share.rb +0 -1
  113. data/lib/contrast/utils/os.rb +16 -4
  114. data/lib/contrast/utils/stack_trace_utils.rb +0 -1
  115. data/lib/contrast/utils/tag_util.rb +1 -1
  116. data/lib/contrast/utils/thread_tracker.rb +1 -14
  117. data/lib/contrast/utils/timer.rb +1 -17
  118. data/ruby-agent.gemspec +4 -4
  119. metadata +48 -72
  120. data/funchook/Makefile +0 -29
  121. data/funchook/autom4te.cache/output.0 +0 -4964
  122. data/funchook/autom4te.cache/requests +0 -77
  123. data/funchook/autom4te.cache/traces.0 +0 -361
  124. data/funchook/config.log +0 -651
  125. data/funchook/config.status +0 -1015
  126. data/funchook/configure +0 -4964
  127. data/funchook/src/Makefile +0 -70
  128. data/funchook/src/config.h +0 -101
  129. data/funchook/src/config.h.in +0 -100
  130. data/funchook/src/decoder.o +0 -0
  131. data/funchook/src/distorm.o +0 -0
  132. data/funchook/src/funchook.o +0 -0
  133. data/funchook/src/funchook_io.o +0 -0
  134. data/funchook/src/funchook_syscall.o +0 -0
  135. data/funchook/src/funchook_unix.o +0 -0
  136. data/funchook/src/funchook_x86.o +0 -0
  137. data/funchook/src/instructions.o +0 -0
  138. data/funchook/src/insts.o +0 -0
  139. data/funchook/src/libfunchook.dylib +0 -0
  140. data/funchook/src/mnemonics.o +0 -0
  141. data/funchook/src/operands.o +0 -0
  142. data/funchook/src/os_func.o +0 -0
  143. data/funchook/src/os_func_unix.o +0 -0
  144. data/funchook/src/prefix.o +0 -0
  145. data/funchook/src/printf_base.o +0 -0
  146. data/funchook/src/textdefs.o +0 -0
  147. data/funchook/src/wstring.o +0 -0
  148. data/funchook/test/Makefile +0 -43
  149. data/funchook/test/funchook_test +0 -0
  150. data/funchook/test/libfunchook_test.so +0 -0
  151. data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist +0 -20
  152. data/funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so +0 -0
  153. data/funchook/test/test_main.o +0 -0
  154. data/funchook/test/x86_64_test.o +0 -0
  155. data/lib/contrast/agent/assess/adjusted_span.rb +0 -27
  156. data/lib/contrast/agent/socket_client.rb +0 -134
  157. data/lib/contrast/api/connection_status.rb +0 -49
  158. data/lib/contrast/api/socket.rb +0 -43
  159. data/lib/contrast/api/speedracer.rb +0 -188
  160. data/lib/contrast/api/tcp_socket.rb +0 -29
  161. data/lib/contrast/api/unix_socket.rb +0 -25
  162. data/lib/contrast/framework/sinatra/application_helper.rb +0 -51
  163. data/lib/contrast/framework/view_technologies_descriptor.rb +0 -21
  164. data/lib/contrast/internal_exception.rb +0 -8
  165. data/lib/contrast/utils/cache.rb +0 -58
  166. data/lib/contrast/utils/service_sender_util.rb +0 -167
  167. data/lib/contrast/utils/sinatra_helper.rb +0 -49
@@ -1,167 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- cs__scoped_require 'contrast/components/interface'
5
-
6
- module Contrast
7
- module Utils
8
- # This module keeps a background thread, initialized at startup, running. This thread is
9
- # responsible for pulling a message off the queue, sending that message to SpeedRacer, and
10
- # processing the response returned back from SpeedRacer. When we didn't know our config
11
- # values, we may have queued assess messages to send later. This thread is also
12
- # responsible for checking to see if we are now ready to send any of these assess messages
13
- # to SpeedRacer.
14
- module ServiceSenderUtil
15
- include Contrast::Components::Interface
16
- access_component :analysis, :app_context, :logging, :settings
17
-
18
- class << self
19
- # Push the given DTM into a queue to be sent to the Service.
20
- #
21
- # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
22
- # Contrast::Api::Dtm::Message
23
- def push_to_ready_queue event
24
- return unless event
25
-
26
- prep_queue
27
- ready_messages_queue.push event
28
- logger.debug('Enqueued event',
29
- event_id: event.__id__,
30
- event_type: event.cs__class.name,
31
- queue: ready_messages_queue.__id__,
32
- length: ready_messages_queue.length)
33
- end
34
-
35
- # Bypass the queue and send the message directly to SpeedRacer. This is the only way
36
- # to receive the response object back from SpeedRacer. An invoking method that needs
37
- # to process the response object with custom logic should use this method.
38
- #
39
- # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
40
- # field of Contrast::Api::Dtm::Message
41
- # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
42
- def send_event_immediately event
43
- client.send_to_speedracer(event) if event
44
- end
45
-
46
- def sending_thread
47
- return @_sender_thread if @_sender_thread
48
-
49
- # in case we got here before a message attempted to be sent, let's make sure these are initialized
50
- @_sender_thread ||= Contrast::Agent::Thread.new do
51
- loop do
52
- check_assess_queue
53
- # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
54
- event = ready_messages_queue.pop
55
- begin
56
- logger.debug('Dequeued event',
57
- event_id: event.__id__,
58
- event_type: event.cs__class.name,
59
- queue: ready_messages_queue.__id__,
60
- length: ready_messages_queue.length)
61
- response = client.send_to_speedracer(event)
62
- Contrast::Utils::ServiceResponseUtil.process_response(response) if response
63
- rescue StandardError => e
64
- logger.error('Could not send message to service from service sender thread.', e)
65
- end
66
- end
67
- end
68
- logger.debug('Started background sending thread.')
69
- end
70
- alias_method :start, :sending_thread
71
-
72
- def stop
73
- Thread.kill(@_sender_thread) if @_sender_thread&.alive?
74
- end
75
-
76
- def add_to_assess_messages msg
77
- assess_messages! << msg
78
- end
79
-
80
- # Return true if the agent has connected with the service
81
- def connection_established?
82
- client.connection_established?
83
- end
84
-
85
- private
86
-
87
- # TODO: RUBY-920
88
- # If we've been forked, then we need to make sure the sender is set and
89
- # alive. This is a temporary workaround to address issues in Passenger
90
- # around forking and will be addressed next sprint.
91
- def prep_queue
92
- return if @_sender_thread&.alive?
93
-
94
- @_sender_thread = nil
95
- start
96
- end
97
-
98
- def ready_messages_queue
99
- @_ready_messages_queue ||= begin
100
- tmp = Queue.new
101
- logger.debug('Creating new ready_messages_queue.',
102
- queue: tmp.__id__,
103
- length: tmp.length)
104
- tmp
105
- end
106
- end
107
-
108
- def assess_messages!
109
- unless @_assess_messages
110
- logger.debug('Creating new assess messages queue by force.')
111
- @_assess_messages = nil
112
- end
113
- assess_messages
114
- end
115
-
116
- # This list holds messages containing assess findings. We may not
117
- # know if the agent is running in assess, so until we do then we
118
- # must keep the messages stored here. Once we do know, we'll set this
119
- # to `false` and rely on the standard ready_messages_queue
120
- def assess_messages
121
- if @_assess_messages.nil?
122
- logger.debug('Creating new assess messages queue.')
123
- @_assess_messages = []
124
- end
125
- @_assess_messages
126
- end
127
-
128
- def client
129
- @_client ||= Contrast::Agent::SocketClient.new
130
- end
131
-
132
- def check_assess_queue
133
- return unless assess_messages
134
- return unless APP_CONTEXT.ready?
135
-
136
- if ASSESS.enabled?
137
- assess_messages.each do |msg|
138
- update_queued_finding msg
139
- ready_messages_queue.push msg # this message is ready to be sent to SR
140
- end
141
- end
142
- @_assess_messages = false # clear out queue, we no longer need it
143
- end
144
-
145
- # When we queued up findings, we didn't have access to a configuration
146
- # object. As such, we have to make decisions now for those findings.
147
- def update_queued_finding msg
148
- # Findings only exist in activity messages
149
- return unless msg.is_a?(Contrast::Api::Dtm::Activity)
150
-
151
- # So set their tags
152
- msg.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
153
-
154
- # and see if they're even enabled
155
- check = msg.findings.dup
156
- check.each do |finding|
157
- msg.findings.delete(finding) if ASSESS.rule_disabled?(finding.rule_id)
158
- end
159
-
160
- msg.findings.each do |finding|
161
- finding.session_id = SETTINGS.session_id
162
- end
163
- end
164
- end
165
- end
166
- end
167
- end
@@ -1,49 +0,0 @@
1
- # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
- # frozen_string_literal: true
3
-
4
- module Contrast
5
- module Utils
6
- # This module is to help perform sometimes necessary tasks specific to Sinatra
7
- module SinatraHelper
8
- SINATRA_VIEWS = [
9
- ['public/stylesheets', '*.scss', %w[SASS]],
10
- ['views', '*.html', %w[HTML5]],
11
- ['views', '*.html.erb', %w[HTML5 ERB]],
12
- ['views', '*.html.haml', %w[HTML5 HAML]],
13
- ['public', '*.html', %w[HTML5]]
14
- ].cs__freeze
15
-
16
- def self.app_class
17
- @_app_class ||= begin
18
- return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
19
-
20
- sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
21
- result_layer = sinatra_layers.find { |layer| layer.app.nil? }
22
- result_layer
23
- end
24
- end
25
-
26
- def self.scannable_view_dirs
27
- @_scannable_view_dirs ||= begin
28
- views = SINATRA_VIEWS.dup
29
- views << [view_directory, '*.erb', %w[HTML5 ERB]] if view_directory
30
- views << [view_directory, '*.haml', %w[HTML5 HAML]] if view_directory
31
- views << [public_directory, '*.html', %w[HTML5]] if public_directory
32
- views
33
- end
34
- end
35
-
36
- def self.view_directory
37
- @_view_directory ||= begin
38
- app_class&.settings&.views
39
- end
40
- end
41
-
42
- def self.public_directory
43
- @_public_directory ||= begin
44
- app_class&.settings&.public_dir
45
- end
46
- end
47
- end
48
- end
49
- end