contrast-agent 3.12.2 → 3.13.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (167) hide show
  1. checksums.yaml +4 -4
  2. data/.dockerignore +0 -1
  3. data/.gitignore +1 -1
  4. data/.simplecov +1 -1
  5. data/Rakefile +31 -0
  6. data/ext/build_funchook.rb +0 -2
  7. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -8
  8. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +0 -1
  9. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -6
  10. data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -5
  11. data/ext/cs__assess_yield_track/cs__assess_yield_track.h +0 -1
  12. data/ext/cs__common/cs__common.c +24 -0
  13. data/ext/cs__common/cs__common.h +3 -0
  14. data/ext/cs__common/extconf.rb +0 -14
  15. data/ext/extconf_common.rb +0 -28
  16. data/lib/contrast.rb +3 -1
  17. data/lib/contrast/agent.rb +14 -2
  18. data/lib/contrast/agent/assess/contrast_event.rb +28 -167
  19. data/lib/contrast/agent/assess/events/source_event.rb +3 -7
  20. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
  21. data/lib/contrast/agent/assess/policy/policy_node.rb +4 -98
  22. data/lib/contrast/agent/assess/policy/propagation_method.rb +1 -2
  23. data/lib/contrast/agent/assess/policy/propagation_node.rb +5 -1
  24. data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
  25. data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -4
  26. data/lib/contrast/agent/assess/policy/propagator/match_data.rb +9 -1
  27. data/lib/contrast/agent/assess/policy/propagator/remove.rb +6 -11
  28. data/lib/contrast/agent/assess/policy/propagator/select.rb +4 -4
  29. data/lib/contrast/agent/assess/policy/propagator/split.rb +2 -2
  30. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +4 -4
  31. data/lib/contrast/agent/assess/policy/propagator/trim.rb +6 -10
  32. data/lib/contrast/agent/assess/policy/source_method.rb +1 -2
  33. data/lib/contrast/agent/assess/policy/trigger_method.rb +1 -9
  34. data/lib/contrast/agent/assess/policy/trigger_node.rb +16 -4
  35. data/lib/contrast/agent/assess/properties.rb +4 -382
  36. data/lib/contrast/agent/assess/property/evented.rb +78 -0
  37. data/lib/contrast/agent/assess/property/tagged.rb +339 -0
  38. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -20
  39. data/lib/contrast/agent/assess/tag.rb +27 -12
  40. data/lib/contrast/agent/at_exit_hook.rb +3 -1
  41. data/lib/contrast/agent/exclusion_matcher.rb +2 -2
  42. data/lib/contrast/agent/inventory/policy/datastores.rb +0 -1
  43. data/lib/contrast/agent/middleware.rb +2 -14
  44. data/lib/contrast/agent/patching/policy/patch.rb +1 -1
  45. data/lib/contrast/agent/patching/policy/policy.rb +3 -3
  46. data/lib/contrast/agent/patching/policy/policy_node.rb +2 -2
  47. data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
  48. data/lib/contrast/agent/protect/rule/base.rb +19 -31
  49. data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
  50. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +2 -7
  51. data/lib/contrast/agent/protect/rule/xxe.rb +1 -0
  52. data/lib/contrast/agent/reaction_processor.rb +3 -3
  53. data/lib/contrast/agent/request.rb +92 -331
  54. data/lib/contrast/agent/request_context.rb +15 -15
  55. data/lib/contrast/agent/request_handler.rb +1 -1
  56. data/lib/contrast/agent/response.rb +2 -14
  57. data/lib/contrast/agent/scope.rb +1 -1
  58. data/lib/contrast/agent/service_heartbeat.rb +7 -9
  59. data/lib/contrast/agent/static_analysis.rb +1 -1
  60. data/lib/contrast/agent/thread_watcher.rb +49 -0
  61. data/lib/contrast/agent/version.rb +1 -1
  62. data/lib/contrast/agent/worker_thread.rb +24 -0
  63. data/lib/contrast/api.rb +3 -5
  64. data/lib/contrast/api/communication.rb +20 -0
  65. data/lib/contrast/api/communication/connection_status.rb +41 -0
  66. data/lib/contrast/api/communication/messaging_queue.rb +79 -0
  67. data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb} +9 -18
  68. data/lib/contrast/api/communication/service_lifecycle.rb +61 -0
  69. data/lib/contrast/api/communication/socket.rb +45 -0
  70. data/lib/contrast/api/communication/socket_client.rb +76 -0
  71. data/lib/contrast/api/communication/speedracer.rb +111 -0
  72. data/lib/contrast/api/communication/tcp_socket.rb +31 -0
  73. data/lib/contrast/api/communication/unix_socket.rb +27 -0
  74. data/lib/contrast/api/decorators.rb +10 -0
  75. data/lib/contrast/api/decorators/address.rb +60 -0
  76. data/lib/contrast/api/decorators/application_settings.rb +7 -3
  77. data/lib/contrast/api/decorators/application_update.rb +0 -9
  78. data/lib/contrast/api/decorators/http_request.rb +139 -0
  79. data/lib/contrast/api/decorators/message.rb +75 -0
  80. data/lib/contrast/api/decorators/rasp_rule_sample.rb +28 -0
  81. data/lib/contrast/api/decorators/route_coverage.rb +57 -0
  82. data/lib/contrast/api/decorators/trace_event.rb +99 -0
  83. data/lib/contrast/api/decorators/trace_event_object.rb +57 -0
  84. data/lib/contrast/api/decorators/trace_event_signature.rb +46 -0
  85. data/lib/contrast/api/decorators/trace_taint_range.rb +51 -0
  86. data/lib/contrast/api/decorators/trace_taint_range_tags.rb +109 -0
  87. data/lib/contrast/api/decorators/user_input.rb +40 -0
  88. data/lib/contrast/components/app_context.rb +0 -7
  89. data/lib/contrast/components/config.rb +4 -9
  90. data/lib/contrast/components/interface.rb +1 -1
  91. data/lib/contrast/components/settings.rb +0 -6
  92. data/lib/contrast/extension/assess.rb +0 -1
  93. data/lib/contrast/extension/assess/assess_extension.rb +1 -2
  94. data/lib/contrast/extension/assess/fiber.rb +1 -1
  95. data/lib/contrast/extension/assess/string.rb +1 -1
  96. data/lib/contrast/extension/inventory.rb +0 -1
  97. data/lib/contrast/framework/base_support.rb +0 -23
  98. data/lib/contrast/framework/manager.rb +0 -9
  99. data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -3
  100. data/lib/contrast/framework/rails/patch/assess_configuration.rb +3 -4
  101. data/lib/contrast/framework/rails/support.rb +3 -32
  102. data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
  103. data/lib/contrast/framework/sinatra/support.rb +11 -22
  104. data/lib/contrast/funchook/funchook.rb +45 -0
  105. data/lib/contrast/logger/application.rb +1 -1
  106. data/lib/contrast/logger/format.rb +51 -0
  107. data/lib/contrast/logger/log.rb +8 -2
  108. data/lib/contrast/utils/assess/tracking_util.rb +45 -20
  109. data/lib/contrast/utils/hash_digest.rb +11 -2
  110. data/lib/contrast/utils/invalid_configuration_util.rb +1 -17
  111. data/lib/contrast/utils/inventory_util.rb +2 -7
  112. data/lib/contrast/utils/object_share.rb +0 -1
  113. data/lib/contrast/utils/os.rb +16 -4
  114. data/lib/contrast/utils/stack_trace_utils.rb +0 -1
  115. data/lib/contrast/utils/tag_util.rb +1 -1
  116. data/lib/contrast/utils/thread_tracker.rb +1 -14
  117. data/lib/contrast/utils/timer.rb +1 -17
  118. data/ruby-agent.gemspec +4 -4
  119. metadata +48 -72
  120. data/funchook/Makefile +0 -29
  121. data/funchook/autom4te.cache/output.0 +0 -4964
  122. data/funchook/autom4te.cache/requests +0 -77
  123. data/funchook/autom4te.cache/traces.0 +0 -361
  124. data/funchook/config.log +0 -651
  125. data/funchook/config.status +0 -1015
  126. data/funchook/configure +0 -4964
  127. data/funchook/src/Makefile +0 -70
  128. data/funchook/src/config.h +0 -101
  129. data/funchook/src/config.h.in +0 -100
  130. data/funchook/src/decoder.o +0 -0
  131. data/funchook/src/distorm.o +0 -0
  132. data/funchook/src/funchook.o +0 -0
  133. data/funchook/src/funchook_io.o +0 -0
  134. data/funchook/src/funchook_syscall.o +0 -0
  135. data/funchook/src/funchook_unix.o +0 -0
  136. data/funchook/src/funchook_x86.o +0 -0
  137. data/funchook/src/instructions.o +0 -0
  138. data/funchook/src/insts.o +0 -0
  139. data/funchook/src/libfunchook.dylib +0 -0
  140. data/funchook/src/mnemonics.o +0 -0
  141. data/funchook/src/operands.o +0 -0
  142. data/funchook/src/os_func.o +0 -0
  143. data/funchook/src/os_func_unix.o +0 -0
  144. data/funchook/src/prefix.o +0 -0
  145. data/funchook/src/printf_base.o +0 -0
  146. data/funchook/src/textdefs.o +0 -0
  147. data/funchook/src/wstring.o +0 -0
  148. data/funchook/test/Makefile +0 -43
  149. data/funchook/test/funchook_test +0 -0
  150. data/funchook/test/libfunchook_test.so +0 -0
  151. data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist +0 -20
  152. data/funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so +0 -0
  153. data/funchook/test/test_main.o +0 -0
  154. data/funchook/test/x86_64_test.o +0 -0
  155. data/lib/contrast/agent/assess/adjusted_span.rb +0 -27
  156. data/lib/contrast/agent/socket_client.rb +0 -134
  157. data/lib/contrast/api/connection_status.rb +0 -49
  158. data/lib/contrast/api/socket.rb +0 -43
  159. data/lib/contrast/api/speedracer.rb +0 -188
  160. data/lib/contrast/api/tcp_socket.rb +0 -29
  161. data/lib/contrast/api/unix_socket.rb +0 -25
  162. data/lib/contrast/framework/sinatra/application_helper.rb +0 -51
  163. data/lib/contrast/framework/view_technologies_descriptor.rb +0 -21
  164. data/lib/contrast/internal_exception.rb +0 -8
  165. data/lib/contrast/utils/cache.rb +0 -58
  166. data/lib/contrast/utils/service_sender_util.rb +0 -167
  167. data/lib/contrast/utils/sinatra_helper.rb +0 -49
@@ -0,0 +1,46 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ cs__scoped_require 'contrast/utils/string_utils'
5
+ cs__scoped_require 'contrast/utils/assess/tracking_util'
6
+ cs__scoped_require 'base64'
7
+
8
+ module Contrast
9
+ module Api
10
+ module Decorators
11
+ # Used to decorate the TraceEventSignature protobuf model
12
+ module TraceEventSignature
13
+ def self.included klass
14
+ klass.extend(ClassMethods)
15
+ end
16
+
17
+ # Class methods for TraceEventSignature
18
+ module ClassMethods
19
+ def build ret_obj, policy_node, args
20
+ signature = new
21
+ return_type = ret_obj ? ret_obj.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
22
+ signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
23
+ signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
24
+ signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
25
+ if args
26
+ args&.each do |arg|
27
+ arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
28
+ signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
29
+ end
30
+ end
31
+ signature.constructor = policy_node.method_name == :new
32
+ # if there's a ret, then this method isn't nil. not 100% full proof since you can
33
+ # return nil, but this is the best we've got currently.
34
+ signature.void_method = ret_obj.nil?
35
+ # 8 is STATIC in Java... we have to placate them for now
36
+ # it has been requested that flags be removed since it isn't used
37
+ signature.flags = 8 unless policy_node.instance_method?
38
+ signature
39
+ end
40
+ end
41
+ end
42
+ end
43
+ end
44
+ end
45
+
46
+ Contrast::Api::Dtm::TraceEventSignature.include(Contrast::Api::Decorators::TraceEventSignature)
@@ -0,0 +1,51 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ cs__scoped_require 'contrast/utils/object_share'
5
+ cs__scoped_require 'contrast/utils/string_utils'
6
+
7
+ module Contrast
8
+ module Api
9
+ module Decorators
10
+ # Used to decorate the TraceTaintRange protobuf model
11
+ module TraceTaintRange
12
+ def self.included klass
13
+ klass.extend(ClassMethods)
14
+ end
15
+
16
+ # Class methods for TraceEventObject
17
+ module ClassMethods
18
+ # Convert the tags from Contrast::Agent::Assess::Property::Tagged to
19
+ # the form required for their Event's DTM.
20
+ #
21
+ # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}]
22
+ # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
23
+ def build_for_event tags
24
+ return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
25
+
26
+ ranges = []
27
+ tags.each_value do |value|
28
+ next if value.empty?
29
+
30
+ value.each { |tag| ranges << build(tag) }
31
+ end
32
+ ranges
33
+ end
34
+
35
+ # Convert our Tags to their DTM equivalent
36
+ #
37
+ # @param tag [Contrast::Agent::Assess::Tag]
38
+ # @return [Contrast::Api::Dtm::TraceTaintRange]
39
+ def build tag
40
+ range = Contrast::Api::Dtm::TraceTaintRange.new
41
+ range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(tag.label)
42
+ range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
43
+ range
44
+ end
45
+ end
46
+ end
47
+ end
48
+ end
49
+ end
50
+
51
+ Contrast::Api::Dtm::TraceTaintRange.include(Contrast::Api::Decorators::TraceTaintRange)
@@ -0,0 +1,109 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ module Contrast
5
+ module Api
6
+ module Decorators
7
+ # A holder for the valid tags that can be sent to the Service, and
8
+ # ultimately TS, that we have to honor. Placed here so as not to clutter
9
+ # other code.
10
+ module TraceTaintRangeTags
11
+ # EventTagTypeDTM
12
+ VALID_TAGS = %w[
13
+ XML_ENCODED
14
+ XML_DECODED
15
+ HTML_ENCODED
16
+ HTML_DECODED
17
+ URL_ENCODED
18
+ URL_DECODED
19
+ CSS_ENCODED
20
+ CSS_DECODED
21
+ BASE64_ENCODED
22
+ BASE64_DECODED
23
+ JAVASCRIPT_ENCODED
24
+ JAVASCRIPT_DECODED
25
+ JAVA_ENCODED
26
+ JAVA_DECODED
27
+ CSV_ENCODED
28
+ CSV_DECODED
29
+ SQL_ENCODED
30
+ SQL_DECODED
31
+ LDAP_ENCODED
32
+ LDAP_DECODED
33
+ XPATH_ENCODED
34
+ XPATH_DECODED
35
+ OS_ENCODED
36
+ OS_DECODED
37
+ VBSCRIPT_ENCODED
38
+ VBSCRIPT_DECODED
39
+ POTENTIAL_SANITIZED
40
+ POTENTIAL_VALIDATED
41
+ NO_CONTROL_CHARS
42
+ CUSTOM
43
+
44
+ CUSTOM_ENCODED
45
+ CUSTOM_ENCODED_CMD_INJECTION
46
+ CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
47
+ CUSTOM_ENCODED_HEADER_INJECTION
48
+ CUSTOM_ENCODED_HQL_INJECTION
49
+ CUSTOM_ENCODED_LDAP_INJECTION
50
+ CUSTOM_ENCODED_LOG_INJECTION
51
+ CUSTOM_ENCODED_NOSQL_INJECTION
52
+ CUSTOM_ENCODED_PATH_TRAVERSAL
53
+ CUSTOM_ENCODED_REDOS
54
+ CUSTOM_ENCODED_REFLECTED_XSS
55
+ CUSTOM_ENCODED_REFLECTION_INJECTION
56
+ CUSTOM_ENCODED_SMTP_INJECTION
57
+ CUSTOM_ENCODED_SQL_INJECTION
58
+ CUSTOM_ENCODED_SSRF
59
+ CUSTOM_ENCODED_STORED_XSS
60
+ CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
61
+ CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
62
+ CUSTOM_ENCODED_UNSAFE_READLINE
63
+ CUSTOM_ENCODED_UNSAFE_XML_DECODE
64
+ CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
65
+ CUSTOM_ENCODED_UNVALIDATED_FORWARD
66
+ CUSTOM_ENCODED_UNVALIDATED_REDIRECT
67
+ CUSTOM_ENCODED_XPATH_INJECTION
68
+ CUSTOM_ENCODED_XXE
69
+ CUSTOM_SECURITY_CONTROL_APPLIED
70
+
71
+ CUSTOM_VALIDATED
72
+ CUSTOM_VALIDATED_CMD_INJECTION
73
+ CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
74
+ CUSTOM_VALIDATED_HEADER_INJECTION
75
+ CUSTOM_VALIDATED_HQL_INJECTION
76
+ CUSTOM_VALIDATED_LDAP_INJECTION
77
+ CUSTOM_VALIDATED_LOG_INJECTION
78
+ CUSTOM_VALIDATED_NOSQL_INJECTION
79
+ CUSTOM_VALIDATED_PATH_TRAVERSAL
80
+ CUSTOM_VALIDATED_REDOS
81
+ CUSTOM_VALIDATED_REFLECTED_XSS
82
+ CUSTOM_VALIDATED_REFLECTION_INJECTION
83
+ CUSTOM_VALIDATED_SMTP_INJECTION
84
+ CUSTOM_VALIDATED_SQL_INJECTION
85
+ CUSTOM_VALIDATED_SSRF
86
+ CUSTOM_VALIDATED_STORED_XSS
87
+ CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
88
+ CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
89
+ CUSTOM_VALIDATED_UNSAFE_READLINE
90
+ CUSTOM_VALIDATED_UNSAFE_XML_DECODE
91
+ CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
92
+ CUSTOM_VALIDATED_UNVALIDATED_FORWARD
93
+ CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
94
+ CUSTOM_VALIDATED_XPATH_INJECTION
95
+ CUSTOM_VALIDATED_XXE
96
+
97
+ DATABASE_WRITE
98
+ ].cs__freeze
99
+
100
+ VALID_SOURCE_TAGS = %w[
101
+ NO_NEWLINES
102
+ UNTRUSTED
103
+ CROSS_SITE
104
+ LIMITED_CHARS
105
+ ].cs__freeze
106
+ end
107
+ end
108
+ end
109
+ end
@@ -0,0 +1,40 @@
1
+ # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
+ # frozen_string_literal: true
3
+
4
+ cs__scoped_require 'contrast/utils/string_utils'
5
+ cs__scoped_require 'contrast/utils/assess/tracking_util'
6
+ cs__scoped_require 'base64'
7
+
8
+ module Contrast
9
+ module Api
10
+ module Decorators
11
+ # Used to decorate the TraceEventObject protobuf model
12
+ module UserInput
13
+ UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
14
+ user_input.input_type = :UNKNOWN
15
+ end.cs__freeze
16
+
17
+ def self.included klass
18
+ klass.extend(ClassMethods)
19
+ end
20
+
21
+ # Used to add class methods to UserInput
22
+ module ClassMethods
23
+ def build_from_ia_result ia_result
24
+ return UNKNOWN_USER_INPUT.dup unless ia_result
25
+
26
+ user_input = new
27
+ user_input.input_type = ia_result.input_type.to_i
28
+ user_input.matcher_ids = ia_result.ids
29
+ user_input.path = ia_result.path.to_s
30
+ user_input.key = ia_result.key.to_s
31
+ user_input.value = ia_result.value.to_s
32
+ user_input
33
+ end
34
+ end
35
+ end
36
+ end
37
+ end
38
+ end
39
+
40
+ Contrast::Api::Dtm::UserInput.include(Contrast::Api::Decorators::UserInput)
@@ -1,7 +1,6 @@
1
1
  # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
- cs__scoped_require 'contrast/utils/sinatra_helper'
5
4
  cs__scoped_require 'rubygems/version'
6
5
 
7
6
  module Contrast
@@ -23,12 +22,6 @@ module Contrast
23
22
  DEFAULT_SERVER_NAME = 'localhost'
24
23
  DEFAULT_SERVER_PATH = '/'
25
24
 
26
- def ready?
27
- @_ready ||= AGENT.enabled? &&
28
- Contrast::Utils::ServiceSenderUtil.connection_established? &&
29
- Contrast::Utils::ServiceResponseUtil.update_received?
30
- end
31
-
32
25
  def initialize
33
26
  original_pid
34
27
  end
@@ -3,6 +3,7 @@
3
3
 
4
4
  cs__scoped_require 'contrast/utils/boolean_util'
5
5
  cs__scoped_require 'contrast/utils/env_configuration_item'
6
+ cs__scoped_require 'contrast/utils/object_share'
6
7
  cs__scoped_require 'contrast/configuration'
7
8
 
8
9
  module Contrast
@@ -69,17 +70,11 @@ module Contrast
69
70
  end
70
71
 
71
72
  def session_id
72
- @_session_id ||= begin
73
- s = raw.application.session_id || ''
74
- s.empty? ? nil : s
75
- end
73
+ @_session_id ||= raw.application.session_id || Contrast::Utils::ObjectShare::EMPTY_STRING
76
74
  end
77
75
 
78
76
  def session_metadata
79
- @_session_metadata ||= begin
80
- s = raw.application.session_metadata || ''
81
- s.empty? ? nil : s
82
- end
77
+ @_session_metadata ||= raw.application.session_metadata || Contrast::Utils::ObjectShare::EMPTY_STRING
83
78
  end
84
79
 
85
80
  def valid?
@@ -98,7 +93,7 @@ module Contrast
98
93
  # If the config is invalid, and you want to know about it, then
99
94
  # you have a circular dependency if you try to log it,
100
95
  # hence `log: false`.
101
- if session_id && session_metadata
96
+ if !session_id.empty? && !session_metadata.empty?
102
97
  if log
103
98
  cs__class.log_error(SESSION_VARIABLES)
104
99
  else
@@ -120,7 +120,7 @@ module Contrast
120
120
 
121
121
  @_access_component[sym] = true
122
122
  else
123
- raise NotImplementedError, "#{ self } asked to access undefined component '#{ sym }'."
123
+ raise NoMethodError, "#{ self } asked to access undefined component '#{ sym }'."
124
124
  end
125
125
  end
126
126
  end
@@ -75,12 +75,6 @@ module Contrast
75
75
  end
76
76
  end
77
77
 
78
- def session_id
79
- # TODO: RUBY-900 we shouldn't send things w/o having session id,
80
- # figure out how this happened and fix it.
81
- application_state[:session_id] || Contrast::Utils::ObjectShare::EMPTY_STRING
82
- end
83
-
84
78
  def initialize
85
79
  reset_state
86
80
  end
@@ -20,7 +20,6 @@ module Contrast
20
20
  cs__scoped_require 'contrast/agent/assess/rule/provider'
21
21
 
22
22
  # tagging / dataflow
23
- cs__scoped_require 'contrast/agent/assess/adjusted_span'
24
23
  cs__scoped_require 'contrast/agent/assess/policy/policy_node'
25
24
  cs__scoped_require 'contrast/agent/assess/policy/source_node'
26
25
  cs__scoped_require 'contrast/agent/assess/policy/source_method'
@@ -122,8 +122,7 @@ module Contrast
122
122
  range = existing[0]
123
123
  range.repurpose(0, ret_length)
124
124
  else
125
- span = Contrast::Agent::Assess::AdjustedSpan.new(0, ret_length)
126
- ret.cs__properties.add_tag(key, span)
125
+ ret.cs__properties.add_tag(key, 0...ret_length)
127
126
  end
128
127
  end
129
128
  end
@@ -99,7 +99,7 @@ module Contrast
99
99
 
100
100
  def instrument_fiber_track
101
101
  @_instrument_fiber_variables ||= begin
102
- cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
102
+ cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
103
103
  true
104
104
  end
105
105
  rescue StandardError, LoadError => e
@@ -65,7 +65,7 @@ module Contrast
65
65
  def instrument_string_interpolation
66
66
  if @_instrument_string_interpolation.nil?
67
67
  @_instrument_string_interpolation = begin
68
- if AGENT.patch_interpolation?
68
+ if AGENT.patch_interpolation? && Funchook.available?
69
69
  cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
70
70
  end
71
71
  true
@@ -11,7 +11,6 @@ module Contrast
11
11
  # relevant given the move to C based patching and the lessons learned
12
12
  # therein.
13
13
  module Inventory
14
- cs__scoped_require 'contrast/internal_exception'
15
14
  cs__scoped_require 'contrast/security_exception'
16
15
  # patching
17
16
  cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
@@ -23,13 +23,6 @@ module Contrast
23
23
  raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
24
24
  end
25
25
 
26
- # Iterate through known locations, looking for files
27
- # that represent view or template files. If found, for each file in the directory
28
- # append the technology and the view object to the application update instance
29
- def scan_views
30
- raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
31
- end
32
-
33
26
  # Find all the predefined routes for this application and append them to the
34
27
  # provided inventory message
35
28
  # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
@@ -73,22 +66,6 @@ module Contrast
73
66
  def streaming? _env
74
67
  false
75
68
  end
76
-
77
- protected
78
-
79
- def source_or_string obj
80
- if obj.cs__is_a?(Regexp)
81
- obj.source
82
- elsif obj.cs__respond_to?(:safe_string)
83
- obj.safe_string
84
- else
85
- obj.to_s
86
- end
87
- end
88
-
89
- def scan_view_directories view_technology_descriptors
90
- view_technology_descriptors.reject(&:empty?)
91
- end
92
69
  end
93
70
  end
94
71
  end
@@ -1,7 +1,6 @@
1
1
  # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
2
2
  # frozen_string_literal: true
3
3
 
4
- cs__scoped_require 'contrast/framework/view_technologies_descriptor'
5
4
  cs__scoped_require 'contrast/framework/platform_version'
6
5
  cs__scoped_require 'contrast/framework/rack/support'
7
6
  cs__scoped_require 'contrast/framework/rails/support'
@@ -59,10 +58,6 @@ module Contrast
59
58
  patches
60
59
  end
61
60
 
62
- def find_applicable_view_technologies
63
- scan_views_for_all_frameworks
64
- end
65
-
66
61
  def find_route_discovery_data
67
62
  routes_for_all_frameworks
68
63
  end
@@ -124,10 +119,6 @@ module Contrast
124
119
  Contrast::Utils::ClassUtil.truly_defined?(klass)
125
120
  end
126
121
 
127
- def scan_views_for_all_frameworks
128
- data_for_all_frameworks :scan_views
129
- end
130
-
131
122
  def routes_for_all_frameworks
132
123
  data_for_all_frameworks :collect_routes
133
124
  end