contrast-agent 3.12.2 → 3.13.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (167) hide show
  1. checksums.yaml +4 -4
  2. data/.dockerignore +0 -1
  3. data/.gitignore +1 -1
  4. data/.simplecov +1 -1
  5. data/Rakefile +31 -0
  6. data/ext/build_funchook.rb +0 -2
  7. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -8
  8. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +0 -1
  9. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -6
  10. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -5
  11. data/ext/cs__assess_yield_track/cs__assess_yield_track.h +0 -1
  12. data/ext/cs__common/cs__common.c +24 -0
  13. data/ext/cs__common/cs__common.h +3 -0
  14. data/ext/cs__common/extconf.rb +0 -14
  15. data/ext/extconf_common.rb +0 -28
  16. data/lib/contrast.rb +3 -1
  17. data/lib/contrast/agent.rb +14 -2
  18. data/lib/contrast/agent/assess/contrast_event.rb +28 -167
  19. data/lib/contrast/agent/assess/events/source_event.rb +3 -7
  20. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  21. data/lib/contrast/agent/assess/policy/policy_node.rb +4 -98
  22. data/lib/contrast/agent/assess/policy/propagation_method.rb +1 -2
  23. data/lib/contrast/agent/assess/policy/propagation_node.rb +5 -1
  24. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  25. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -4
  26. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +9 -1
  27. data/lib/contrast/agent/assess/policy/propagator/remove.rb +6 -11
  28. data/lib/contrast/agent/assess/policy/propagator/select.rb +4 -4
  29. data/lib/contrast/agent/assess/policy/propagator/split.rb +2 -2
  30. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +4 -4
  31. data/lib/contrast/agent/assess/policy/propagator/trim.rb +6 -10
  32. data/lib/contrast/agent/assess/policy/source_method.rb +1 -2
  33. data/lib/contrast/agent/assess/policy/trigger_method.rb +1 -9
  34. data/lib/contrast/agent/assess/policy/trigger_node.rb +16 -4
  35. data/lib/contrast/agent/assess/properties.rb +4 -382
  36. data/lib/contrast/agent/assess/property/evented.rb +78 -0
  37. data/lib/contrast/agent/assess/property/tagged.rb +339 -0
  38. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -20
  39. data/lib/contrast/agent/assess/tag.rb +27 -12
  40. data/lib/contrast/agent/at_exit_hook.rb +3 -1
  41. data/lib/contrast/agent/exclusion_matcher.rb +2 -2
  42. data/lib/contrast/agent/inventory/policy/datastores.rb +0 -1
  43. data/lib/contrast/agent/middleware.rb +2 -14
  44. data/lib/contrast/agent/patching/policy/patch.rb +1 -1
  45. data/lib/contrast/agent/patching/policy/policy.rb +3 -3
  46. data/lib/contrast/agent/patching/policy/policy_node.rb +2 -2
  47. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  48. data/lib/contrast/agent/protect/rule/base.rb +19 -31
  49. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  50. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +2 -7
  51. data/lib/contrast/agent/protect/rule/xxe.rb +1 -0
  52. data/lib/contrast/agent/reaction_processor.rb +3 -3
  53. data/lib/contrast/agent/request.rb +92 -331
  54. data/lib/contrast/agent/request_context.rb +15 -15
  55. data/lib/contrast/agent/request_handler.rb +1 -1
  56. data/lib/contrast/agent/response.rb +2 -14
  57. data/lib/contrast/agent/scope.rb +1 -1
  58. data/lib/contrast/agent/service_heartbeat.rb +7 -9
  59. data/lib/contrast/agent/static_analysis.rb +1 -1
  60. data/lib/contrast/agent/thread_watcher.rb +49 -0
  61. data/lib/contrast/agent/version.rb +1 -1
  62. data/lib/contrast/agent/worker_thread.rb +24 -0
  63. data/lib/contrast/api.rb +3 -5
  64. data/lib/contrast/api/communication.rb +20 -0
  65. data/lib/contrast/api/communication/connection_status.rb +41 -0
  66. data/lib/contrast/api/communication/messaging_queue.rb +79 -0
  67. data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb} +9 -18
  68. data/lib/contrast/api/communication/service_lifecycle.rb +61 -0
  69. data/lib/contrast/api/communication/socket.rb +45 -0
  70. data/lib/contrast/api/communication/socket_client.rb +76 -0
  71. data/lib/contrast/api/communication/speedracer.rb +111 -0
  72. data/lib/contrast/api/communication/tcp_socket.rb +31 -0
  73. data/lib/contrast/api/communication/unix_socket.rb +27 -0
  74. data/lib/contrast/api/decorators.rb +10 -0
  75. data/lib/contrast/api/decorators/address.rb +60 -0
  76. data/lib/contrast/api/decorators/application_settings.rb +7 -3
  77. data/lib/contrast/api/decorators/application_update.rb +0 -9
  78. data/lib/contrast/api/decorators/http_request.rb +139 -0
  79. data/lib/contrast/api/decorators/message.rb +75 -0
  80. data/lib/contrast/api/decorators/rasp_rule_sample.rb +28 -0
  81. data/lib/contrast/api/decorators/route_coverage.rb +57 -0
  82. data/lib/contrast/api/decorators/trace_event.rb +99 -0
  83. data/lib/contrast/api/decorators/trace_event_object.rb +57 -0
  84. data/lib/contrast/api/decorators/trace_event_signature.rb +46 -0
  85. data/lib/contrast/api/decorators/trace_taint_range.rb +51 -0
  86. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +109 -0
  87. data/lib/contrast/api/decorators/user_input.rb +40 -0
  88. data/lib/contrast/components/app_context.rb +0 -7
  89. data/lib/contrast/components/config.rb +4 -9
  90. data/lib/contrast/components/interface.rb +1 -1
  91. data/lib/contrast/components/settings.rb +0 -6
  92. data/lib/contrast/extension/assess.rb +0 -1
  93. data/lib/contrast/extension/assess/assess_extension.rb +1 -2
  94. data/lib/contrast/extension/assess/fiber.rb +1 -1
  95. data/lib/contrast/extension/assess/string.rb +1 -1
  96. data/lib/contrast/extension/inventory.rb +0 -1
  97. data/lib/contrast/framework/base_support.rb +0 -23
  98. data/lib/contrast/framework/manager.rb +0 -9
  99. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -3
  100. data/lib/contrast/framework/rails/patch/assess_configuration.rb +3 -4
  101. data/lib/contrast/framework/rails/support.rb +3 -32
  102. data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
  103. data/lib/contrast/framework/sinatra/support.rb +11 -22
  104. data/lib/contrast/funchook/funchook.rb +45 -0
  105. data/lib/contrast/logger/application.rb +1 -1
  106. data/lib/contrast/logger/format.rb +51 -0
  107. data/lib/contrast/logger/log.rb +8 -2
  108. data/lib/contrast/utils/assess/tracking_util.rb +45 -20
  109. data/lib/contrast/utils/hash_digest.rb +11 -2
  110. data/lib/contrast/utils/invalid_configuration_util.rb +1 -17
  111. data/lib/contrast/utils/inventory_util.rb +2 -7
  112. data/lib/contrast/utils/object_share.rb +0 -1
  113. data/lib/contrast/utils/os.rb +16 -4
  114. data/lib/contrast/utils/stack_trace_utils.rb +0 -1
  115. data/lib/contrast/utils/tag_util.rb +1 -1
  116. data/lib/contrast/utils/thread_tracker.rb +1 -14
  117. data/lib/contrast/utils/timer.rb +1 -17
  118. data/ruby-agent.gemspec +4 -4
  119. metadata +48 -72
  120. data/funchook/Makefile +0 -29
  121. data/funchook/autom4te.cache/output.0 +0 -4964
  122. data/funchook/autom4te.cache/requests +0 -77
  123. data/funchook/autom4te.cache/traces.0 +0 -361
  124. data/funchook/config.log +0 -651
  125. data/funchook/config.status +0 -1015
  126. data/funchook/configure +0 -4964
  127. data/funchook/src/Makefile +0 -70
  128. data/funchook/src/config.h +0 -101
  129. data/funchook/src/config.h.in +0 -100
  130. data/funchook/src/decoder.o +0 -0
  131. data/funchook/src/distorm.o +0 -0
  132. data/funchook/src/funchook.o +0 -0
  133. data/funchook/src/funchook_io.o +0 -0
  134. data/funchook/src/funchook_syscall.o +0 -0
  135. data/funchook/src/funchook_unix.o +0 -0
  136. data/funchook/src/funchook_x86.o +0 -0
  137. data/funchook/src/instructions.o +0 -0
  138. data/funchook/src/insts.o +0 -0
  139. data/funchook/src/libfunchook.dylib +0 -0
  140. data/funchook/src/mnemonics.o +0 -0
  141. data/funchook/src/operands.o +0 -0
  142. data/funchook/src/os_func.o +0 -0
  143. data/funchook/src/os_func_unix.o +0 -0
  144. data/funchook/src/prefix.o +0 -0
  145. data/funchook/src/printf_base.o +0 -0
  146. data/funchook/src/textdefs.o +0 -0
  147. data/funchook/src/wstring.o +0 -0
  148. data/funchook/test/Makefile +0 -43
  149. data/funchook/test/funchook_test +0 -0
  150. data/funchook/test/libfunchook_test.so +0 -0
  151. data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist +0 -20
  152. data/funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so +0 -0
  153. data/funchook/test/test_main.o +0 -0
  154. data/funchook/test/x86_64_test.o +0 -0
  155. data/lib/contrast/agent/assess/adjusted_span.rb +0 -27
  156. data/lib/contrast/agent/socket_client.rb +0 -134
  157. data/lib/contrast/api/connection_status.rb +0 -49
  158. data/lib/contrast/api/socket.rb +0 -43
  159. data/lib/contrast/api/speedracer.rb +0 -188
  160. data/lib/contrast/api/tcp_socket.rb +0 -29
  161. data/lib/contrast/api/unix_socket.rb +0 -25
  162. data/lib/contrast/framework/sinatra/application_helper.rb +0 -51
  163. data/lib/contrast/framework/view_technologies_descriptor.rb +0 -21
  164. data/lib/contrast/internal_exception.rb +0 -8
  165. data/lib/contrast/utils/cache.rb +0 -58
  166. data/lib/contrast/utils/service_sender_util.rb +0 -167
  167. data/lib/contrast/utils/sinatra_helper.rb +0 -49
@@ -0,0 +1,78 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ cs__scoped_require 'contrast/agent/assess/events/event_factory'
5
+ cs__scoped_require 'contrast/agent/assess/events/source_event'
6
+
7
+ module Contrast
8
+ module Agent
9
+ module Assess
10
+ module Property
11
+ # This module serves to hold the functionality required for the
12
+ # management of our dataflow events.
13
+ module Evented
14
+ # The events for this object.
15
+ #
16
+ # @return [Array<Contrast::Agent::Assess::ContrastEvent>]
17
+ def events
18
+ @_events ||= []
19
+ end
20
+
21
+ # Add an event to these properties. It will be used to build
22
+ # a trace if this object ends up in a trigger.
23
+ #
24
+ # @param event [Contrast::Agent::Assess::ContrastEvent] the latest
25
+ # event to track
26
+ def add_event event
27
+ events << event
28
+ self
29
+ end
30
+
31
+ # Create a new event and add it to the event set.
32
+ #
33
+ # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
34
+ # the node that governs this event.
35
+ # @param tagged [Object] the Target to which this event pertains.
36
+ # @param object [Object] the Object on which the method was invoked
37
+ # @param ret [Object] the Return of the invoked method
38
+ # @param args [Array<Object>] the Arguments with which the method
39
+ # was invoked
40
+ # @param source_type [String] the type of this source, from the
41
+ # source_node, or a KEY_TYPE if invoked for a map
42
+ # @param source_name [String, nil] the name of this source, i.e.
43
+ # the key used to accessed if from a map or nil if a type like
44
+ # BODY
45
+ def build_event policy_node, tagged, object, ret, args, source_type = nil, source_name = nil
46
+ event = Contrast::Agent::Assess::Events::EventFactory.build(policy_node, tagged, object, ret, args, source_type, source_name)
47
+ add_event(event)
48
+ report_sources(tagged, event)
49
+ end
50
+
51
+ private
52
+
53
+ # Append the sources of the given event to the current request
54
+ # context's observed route
55
+ #
56
+ # @param tagged [Object] The Target of the Event
57
+ # @param event [Contrast::Agent::Assess::Events::ContrastEvent]
58
+ def report_sources tagged, event
59
+ return unless tagged && !tagged.to_s.empty?
60
+ return unless event.cs__is_a?(Contrast::Agent::Assess::Events::SourceEvent)
61
+ return unless event.source_type
62
+
63
+ current_request = Contrast::Agent::REQUEST_TRACKER.current
64
+ return unless current_request
65
+ if current_request.observed_route.sources.any? { |source| source.type == event.forced_source_type && source.name == event.forced_source_name }
66
+ return
67
+ end
68
+
69
+ event_source_dtm = event.build_event_source_dtm
70
+ return unless event_source_dtm
71
+
72
+ current_request.observed_route.sources << event_source_dtm
73
+ end
74
+ end
75
+ end
76
+ end
77
+ end
78
+ end
@@ -0,0 +1,339 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ cs__scoped_require 'contrast/agent/assess/tag'
5
+ cs__scoped_require 'contrast/utils/object_share'
6
+ cs__scoped_require 'contrast/utils/string_utils'
7
+ cs__scoped_require 'contrast/utils/tag_util'
8
+
9
+ module Contrast
10
+ module Agent
11
+ module Assess
12
+ module Property
13
+ # This module serves to hold the functionality required for the
14
+ # management of our dataflow tags.
15
+ module Tagged
16
+ # Is any tag present?
17
+ # Creating Tags is expensive and we check for Tags all the time on
18
+ # untracked things. ALWAYS!!! call this method before checking if an
19
+ # object has tags
20
+ # @return [Boolean]
21
+ def tracked?
22
+ instance_variable_defined?(:@_tags) && tags.any?
23
+ end
24
+
25
+ # Is the given tag present?
26
+ # Used in testing, so found by `be_tagged`, if you're grepping for it
27
+ #
28
+ # @param label [Symbol] the tag to check for
29
+ # @return [Boolean]
30
+ def tagged? label
31
+ tracked? && tags.key?(label)
32
+ end
33
+
34
+ # Similar to #tracked?, but limited to a given range.
35
+ #
36
+ # @param start [Integer] the inclusive start index to check.
37
+ # @param finish [Integer] the exclusive end index to check.
38
+ # @return [Boolean]
39
+ def any_tags_between? start, finish
40
+ return false unless tracked?
41
+
42
+ tags.each_value do |tag_array|
43
+ return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
44
+ end
45
+ false
46
+ end
47
+
48
+ # Find all of the ranges that span a given index. This is used
49
+ # in propagation when we need to shift tags about. For instance, in
50
+ # the append method when we need to see if any tag at the end needs
51
+ # to be expanded out to the size of the new String.
52
+ #
53
+ # Note: Tags do not know their key, so this is only the range covered
54
+ #
55
+ # @param idx [Integer] the index to check for tags
56
+ # @return [Array<Contrast::Agent::Assess::Tag>] a set of all the Tags
57
+ # covering the given index. This is only the ranges, not the names.
58
+ def tags_at idx
59
+ return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tracked?
60
+
61
+ at = []
62
+ tags.each_value do |tag_array|
63
+ tag_array.each do |tag|
64
+ if tag.covers?(idx)
65
+ at << tag
66
+ elsif tag.above?(idx)
67
+ break
68
+ end
69
+ end
70
+ end
71
+ at
72
+ end
73
+
74
+ # given a range, select all tags in that range the selected tags are
75
+ # shifted such that the start index of the new tag (0) aligns with
76
+ # the given start index in the range
77
+ #
78
+ # current tags: 5-15
79
+ # range : 5-10
80
+ # result : 0-05
81
+ #
82
+ # @param range [Range] the span to check, inclusive to exclusive
83
+ # @return [Hash{String => Contrast::Agent::Assess::Tag}] the hash of
84
+ # key to tags
85
+ def tags_at_range range
86
+ return Contrast::Utils::ObjectShare::EMPTY_HASH unless tracked?
87
+
88
+ at = Hash.new { |h, k| h[k] = [] }
89
+ tags.each_pair do |key, value|
90
+ add = []
91
+ value.each do |tag|
92
+ comparison = tag.compare_range(range.begin, range.end)
93
+ # BELOW and ABOVE are applicable to this check and are removed.
94
+ case comparison
95
+ # part of the tag is being selected
96
+ when Contrast::Agent::Assess::Tag::LOW_SPAN
97
+ add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
98
+ # the tag exists in the requested range, figure out the boundaries
99
+ when Contrast::Agent::Assess::Tag::WITHIN
100
+ start = tag.start_idx - range.begin
101
+ finish = range.size - start
102
+ add << Contrast::Agent::Assess::Tag.new(tag.label, finish, start)
103
+ # the tag spans the requested range.
104
+ when Contrast::Agent::Assess::Tag::WITHOUT
105
+ add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
106
+ # part of the tag is being selected
107
+ when Contrast::Agent::Assess::Tag::HIGH_SPAN
108
+ add << Contrast::Agent::Assess::Tag.new(tag.label, range.size)
109
+ end
110
+ end
111
+ next if add.empty?
112
+
113
+ at[key] = add
114
+ end
115
+ at
116
+ end
117
+
118
+ # Given a tag name and range object, add a new tag to this
119
+ # collection. If the given range touches an existing tag,
120
+ # we'll combine the two, adjusting the existing one and
121
+ # dropping this new one.
122
+ #
123
+ # @param label [String] the name of the tag
124
+ # @param range [Range] the Range that the tag covers, inclusive to
125
+ # exclusive
126
+ def add_tag label, range
127
+ length = range.end - range.begin
128
+ tag = Contrast::Agent::Assess::Tag.new(label, length, range.begin)
129
+ existing = fetch_tag(label)
130
+ tags[label] = Contrast::Utils::TagUtil.ordered_merge(existing, tag)
131
+ end
132
+
133
+ def set_tags label, tag_ranges
134
+ tags[label] = tag_ranges
135
+ end
136
+
137
+ # Remove all tags with a given label
138
+ def delete_tags label
139
+ tags.delete(label) if tracked?
140
+ end
141
+
142
+ # Reset the tag hash
143
+ def clear_tags
144
+ tags.clear if tracked?
145
+ end
146
+
147
+ # Returns a list of all current tag labels, most likely to be used for
148
+ # a splat operation
149
+ def tag_keys
150
+ return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tracked?
151
+
152
+ tags.keys
153
+ end
154
+
155
+ # Calls merge to combine touching or overlapping tags
156
+ # Deletes empty tags
157
+ def cleanup_tags
158
+ return unless tracked?
159
+
160
+ Contrast::Utils::TagUtil.merge_tags(tags)
161
+ tags.delete_if { |_, value| value.empty? }
162
+ end
163
+
164
+ # We'll use this as a helper method to retrieve tags from the hash.
165
+ # Because the hash auto-populates an empty array when we try to access
166
+ # a tag in it, we cannot use the [] method without side effect. To get
167
+ # around this, we'll use a fetch work around.
168
+ def fetch_tag label
169
+ tags.fetch(label, nil) if tracked?
170
+ end
171
+
172
+ # Convert the tags of this object into the TraceTaintRange required
173
+ # to be sent to the service
174
+ def tags_to_dtm
175
+ Contrast::Api::Dtm::TraceTaintRange.build_for_event(tags)
176
+ end
177
+
178
+ # Remove all tags within the given ranges.
179
+ # This does not delete an entire tag if part of that tag is
180
+ # outside this range, meaning we may reduce sizes of tags
181
+ # or split them.
182
+ #
183
+ # If shift is true, it is assumed the characters at those ranges were
184
+ # removed. If shift is false, it is assumed those ranges were replaced
185
+ # by the same number of characters and no shift is needed.
186
+ #
187
+ # current tags: 0-15
188
+ # range: 5-10
189
+ # result: 0-5, 10-15
190
+ #
191
+ # @param ranges [Array<Range>] the ranges to delete
192
+ # @param shift [Boolean] move remaining tags to the left to account
193
+ # for the deletion
194
+ def delete_tags_at_ranges ranges, shift = true
195
+ return unless tracked?
196
+
197
+ # Stage one - delete the tags w/o changing their
198
+ # location.
199
+ ranges.each do |range|
200
+ remove_tags(range)
201
+ end
202
+ return unless shift
203
+
204
+ # the amount we've already removed from the string
205
+ shift = 0
206
+ # Stage two - shift the tags to the left to account
207
+ # for the sections that were deleted.
208
+ ranges.each do |range|
209
+ shift_tags_for_deletion(range, shift)
210
+ shift += (range.end - range.begin)
211
+ end
212
+
213
+ # Clean up and merge any touching tags
214
+ Contrast::Utils::TagUtil.merge_tags(tags)
215
+ end
216
+
217
+ # Shift all the tags in this object by the given ranges.
218
+ # This method assumes the ranges are sorted, meaning
219
+ # the leftmost (lowest) range is first
220
+ #
221
+ # current tags: 0-15
222
+ # range: 5-10
223
+ # result: 0-5, 10-20
224
+ def shift_tags ranges
225
+ return unless tracked?
226
+
227
+ ranges.each do |range|
228
+ shift_tags_for_insertion(range)
229
+ end
230
+ end
231
+
232
+ # Because of the auto-fill thing, we should not allow direct access to
233
+ # the tags hash. Instead, the methods above should be used to do
234
+ # operations like add, delete, and fetch.
235
+ #
236
+ # CONTRAST-22914
237
+ # please do NOT expose this w/ an attr_reader / accessor. there are
238
+ # helper methods in this class that safely access the hash. the tags
239
+ # method is private to avoid the side effect of a direct lookup with
240
+ # `[]` adding an empty array to the hash.
241
+ def tags
242
+ @_tags ||= Hash.new { |h, k| h[k] = [] }
243
+ end
244
+
245
+ # Remove the tag ranges covering the given range
246
+ def remove_tags range
247
+ return unless tracked?
248
+
249
+ full_delete = []
250
+ tags.each_pair do |key, value|
251
+ remove = []
252
+ add = []
253
+ value.each do |tag|
254
+ comparison = tag.compare_range(range.begin, range.end)
255
+ # ABOVE and BELOW are not affected by this check
256
+ case comparison
257
+ when Contrast::Agent::Assess::Tag::LOW_SPAN
258
+ tag.update_end(range.begin)
259
+ when Contrast::Agent::Assess::Tag::WITHIN
260
+ remove << tag
261
+ when Contrast::Agent::Assess::Tag::WITHOUT
262
+ new_tag = tag.clone
263
+ new_tag.update_start(range.end)
264
+ add << new_tag
265
+ tag.update_end(range.begin)
266
+ when Contrast::Agent::Assess::Tag::HIGH_SPAN
267
+ tag.update_start(range.end)
268
+ end
269
+ end
270
+ value.delete_if { |tag| remove.include?(tag) }
271
+ Contrast::Utils::TagUtil.ordered_merge(value, add)
272
+ full_delete << key if value.empty?
273
+ end
274
+ full_delete.each { |key| tags.delete(key) }
275
+ end
276
+
277
+ # Shift the tag ranges covering the given range
278
+ # We assume this is for a deletion, meaning we
279
+ # have to move tags to the left
280
+ # @param range [Range] the range to delete
281
+ # @param shift [Boolean] move remaining tags to the left to account
282
+ # for the deletion
283
+ def shift_tags_for_deletion range, shift
284
+ return unless tracked?
285
+
286
+ tags.each_value do |value|
287
+ value.each do |tag|
288
+ comparison = tag.compare_range(range.begin - shift, range.end - shift)
289
+ # this is really the only thing we need to shift
290
+ next unless comparison == Contrast::Agent::Assess::Tag::ABOVE
291
+
292
+ length = range.end - range.begin
293
+ tag.shift(0 - length)
294
+ end
295
+ end
296
+ end
297
+
298
+ # Shift the tag ranges covering the given range
299
+ # We assume this is for a insertion, meaning we
300
+ # have to move tags to the right
301
+ def shift_tags_for_insertion range
302
+ return unless tracked?
303
+
304
+ tags.each_value do |value|
305
+ add = []
306
+ value.each do |tag|
307
+ comparison = tag.compare_range(range.begin, range.end)
308
+ length = range.end - range.begin
309
+ # BELOW is not affected by this check
310
+ case comparison
311
+ # part of the tag is being inserted on
312
+ when Contrast::Agent::Assess::Tag::LOW_SPAN
313
+ new_tag = tag.clone
314
+ new_tag.update_start(range.begin)
315
+ new_tag.shift(length)
316
+ add << new_tag
317
+ tag.update_end(range.begin)
318
+ # the tag exists in the inserted range. it is partially shifted
319
+ when Contrast::Agent::Assess::Tag::WITHIN
320
+ tag.shift(length)
321
+ # the tag spans the range. leave the part below alone
322
+ when Contrast::Agent::Assess::Tag::WITHOUT
323
+ new_tag = tag.clone
324
+ new_tag.update_start(range.begin)
325
+ new_tag.shift(length)
326
+ add << new_tag
327
+ tag.update_end(range.begin)
328
+ when Contrast::Agent::Assess::Tag::HIGH_SPAN, Contrast::Agent::Assess::Tag::ABOVE
329
+ tag.shift(length)
330
+ end
331
+ end
332
+ Contrast::Utils::TagUtil.ordered_merge(value, add)
333
+ end
334
+ end
335
+ end
336
+ end
337
+ end
338
+ end
339
+ end
@@ -19,7 +19,7 @@ module Contrast
19
19
  # 4) redacted_marker : the value to plug in for the obfuscated value
20
20
  module HardcodedValueRule
21
21
  include Contrast::Components::Interface
22
- access_component :analysis, :app_context, :logging, :settings
22
+ access_component :analysis, :app_context, :logging
23
23
 
24
24
  def disabled?
25
25
  !ASSESS.enabled? || ASSESS.rule_disabled?(rule_id)
@@ -95,8 +95,6 @@ module Contrast
95
95
 
96
96
  finding = Contrast::Api::Dtm::Finding.new
97
97
  finding.rule_id = Contrast::Utils::StringUtils.protobuf_safe_string(rule_id)
98
- finding.session_id = SETTINGS.session_id
99
-
100
98
  finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
101
99
 
102
100
  finding.properties[SOURCE_KEY] = Contrast::Utils::StringUtils.protobuf_safe_string(class_name)
@@ -110,26 +108,10 @@ module Contrast
110
108
  activity = Contrast::Api::Dtm::Activity.new
111
109
  activity.findings << finding
112
110
 
113
- # If assess is enabled, we can just send the activity
114
- if APP_CONTEXT.ready?
115
- build_tags(activity)
116
- Contrast::Utils::ServiceSenderUtil.push_to_ready_queue activity
117
- # Otherwise, if the Agent isn't ready, we have to queue the messages
118
- # until we know the starting state.
119
- else
120
- Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
121
- end
111
+ Contrast::Agent.messaging_queue.send_event_eventually(activity)
122
112
  rescue StandardError => e
123
113
  logger.error('Unable to build a finding for Hardcoded Rule', e)
124
114
  end
125
-
126
- # This seems silly to pull out, but we can ONLY call this in the case
127
- # where we have a configuration. Doing otherwise results in a bad error
128
- # case where we try to do other things, like logging, which behave
129
- # strangely without a config
130
- def build_tags activity
131
- activity.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
132
- end
133
115
  end
134
116
  end
135
117
  end