contrast-agent 3.12.2 → 3.15.0

data/lib/contrast/agent/request_context.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/inventory_util'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/timer'
+require 'contrast/agent/request'
+require 'contrast/agent/response'
+require 'contrast/utils/inventory_util'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -14,11 +14,12 @@ module Contrast
     # in a standardized and normalized format which the Agent understands.
     class RequestContext
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :logging, :settings, :scope
+      access_component :agent, :analysis, :logging, :scope
 
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
 
       attr_reader :timer,
+                  :logging_hash,
                   :speedracer_input_analysis,
                   :request,
                   :response,
@@ -29,8 +30,11 @@ module Contrast
 
       def initialize rack_request, app_loaded = true
         with_contrast_scope do
-          # all requests get a timer
+          # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new
+          @logging_hash = {
+              request_id: __id__
+          }
 
           # instantiate helper for request and response
           @request = Contrast::Agent::Request.new(rack_request)
@@ -90,7 +94,6 @@ module Contrast
         # For TS routes
         @observed_route.signature  = route.route
         @observed_route.verb       = route.verb
-        @observed_route.session_id = SETTINGS.session_id
         @observed_route.url        = route.url if route.url
       end
 
@@ -113,7 +116,7 @@ module Contrast
         return false unless PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = Contrast::Utils::ServiceSenderUtil.send_event_immediately(@activity.http_request)
+        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)
@@ -127,8 +130,8 @@ module Contrast
           logger.trace('Analysis from Contrast Service was empty.')
           false
         end
-      rescue Contrast::SecurityException
-        raise
+      rescue Contrast::SecurityException => e
+        raise e
       rescue StandardError => e
         logger.warn('Unable to extract Contrast Service information from request', e)
         false
@@ -138,21 +141,20 @@ module Contrast
       # when the protect state indicates a security exception should be thrown. This method
       # ensures that the attack reports are generated. Normally these should be generated on
       # Speedracer for any attacks detected during prefilter.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def handle_protect_state agent_settings
-        return unless agent_settings
-        return unless agent_settings.protect_state
-
-        @uuid = agent_settings.protect_state.uuid
-        @do_not_track = true unless agent_settings.protect_state.track_request
+        return unless agent_settings&.protect_state
 
-        return unless agent_settings.protect_state.security_exception
+        state = agent_settings.protect_state
+        @uuid = state.uuid
+        @do_not_track = true unless state.track_request
+        return unless state.security_exception
 
         # If Contrast Service has NOT handled the input analysis, handle them here
         build_attack_results(agent_settings)
-
-        msg = agent_settings.protect_state.security_message
-        logger.warn('Contrast Service said to block this request')
-        raise Contrast::SecurityException.new(nil, (msg || 'Blocking suspicious behavior'))
+        logger.debug('Contrast Service said to block this request')
+        raise Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior'))
       end
 
       # append anything we've learned to the request seen message
@@ -183,6 +185,8 @@ module Contrast
 
       # Generate attack results directly from any evaluations on the
       # agent settings object.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def build_attack_results agent_settings
         return unless agent_settings&.input_analysis&.results&.any?
 

data/lib/contrast/agent/request_handler.rb

@@ -20,7 +20,7 @@ module Contrast
       def send_activity_messages
         Contrast::Utils::GemfileReader.instance.generate_library_usage(context.activity)
         [context.server_activity, context.activity, context.observed_route].each do |message|
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(message)
+          Contrast::Agent.messaging_queue.send_event_eventually(message)
         end
       end
 

data/lib/contrast/agent/response.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -43,15 +43,10 @@ module Contrast
       def dtm
         context_response = Contrast::Api::Dtm::HttpResponse.new
         context_response.response_code = response_code.to_i
-        headers.each_pair do |key, value|
-          k = Contrast::Utils::StringUtils.force_utf8(key)
-          v = Contrast::Utils::StringUtils.force_utf8(value)
-          context_response.response_headers[k] = v
+        headers&.each_pair do |key, value|
+          append_pair(context_response.normalized_response_headers, key, value)
         end
-        context_response.parsed_response_headers = true
-
         context_response.response_body_binary = Contrast::Utils::StringUtils.force_utf8(body)
-        context_response.parsed_response_body = false
 
         doc_type = document_type
         context_response.document_type = doc_type if doc_type
@@ -75,23 +70,11 @@ module Contrast
         end
       end
 
-      # Header keys upcased and any underscores replaced with dashes
-      # We cannot memoize this, b/c response headers can change during the
-      # request lifecycle.
-      def normalized_headers
-        hash = {}
-        headers.each_pair do |header_name, header_value|
-          hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-        end
-        hash
-      end
-
-      CONTENT_TYPE_HEADER = 'CONTENT-TYPE'.cs__freeze
       def content_type
         return unless rack_response
 
         if @is_array
-          normalized_headers[CONTENT_TYPE_HEADER]
+          headers[Rack::CONTENT_TYPE]
         else
           rack_response.content_type
         end
@@ -109,6 +92,22 @@ module Contrast
 
       private
 
+      # From the dtm for normalized_response_headers:
+      #   Key is UPPERCASE_UNDERSCORE
+      #
+      #   Example: Content-Type: text/html; charset=utf-8
+      #   "CONTENT_TYPE" => Content-Type,["text/html; charset=utf8"]
+      def append_pair map, key, value
+        return unless key && value
+        return if value.is_a?(Hash)
+
+        safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+        hash_key = Contrast::Utils::StringUtils.normalized_key(safe_key)
+        map[hash_key] ||= Contrast::Api::Dtm::Pair.new
+        map[hash_key].key = safe_key
+        map[hash_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+      end
+
       HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
 
       # Given some holder of the content of the response's body, extract that

data/lib/contrast/agent/rewriter.rb

@@ -3,10 +3,10 @@
 
 # intentional -- we're using a << operator here
 
-cs__scoped_require 'contrast/agent/class_reopener'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/ruby_ast_rewriter'
+require 'contrast/agent/class_reopener'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/components/interface'
+require 'contrast/utils/ruby_ast_rewriter'
 
 module Contrast
   module Agent
@@ -61,9 +61,7 @@ module Contrast
           status ||= Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
           status.failed_rewrite!
         ensure
-          with_contrast_scope do
-            opener&.commit_patches
-          end
+          opener&.commit_patches
           logger.trace('Rewriting complete',
                        module: module_data.name,
                        result: Contrast::Agent::Patching::Policy::PatchStatus.get_status(
@@ -163,8 +161,7 @@ module Contrast
 
         def rewrite_method original_source_code
           new_code = rewrite(original_source_code)
-          new_code = remove_self_definition(new_code)
-          new_code
+          remove_self_definition(new_code)
         end
 
         def rewrite source

data/lib/contrast/agent/scope.rb

@@ -107,7 +107,7 @@ module Contrast
         def ensure_valid_scope! scope_sym
           unless valid_scope? scope_sym # rubocop:disable Style/GuardClause
             with_contrast_scope do
-              raise NotImplementedError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
+              raise NoMethodError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
             end
           end
         end

data/lib/contrast/agent/service_heartbeat.rb

@@ -1,39 +1,37 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
+require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent
     # The ServiceHeartbeat functions to keep the Contrast Service alive and
     # ensure that it maintains this Agent's ApplicationContext.
-    class ServiceHeartbeat
+    class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Interface
       access_component :logging
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      def updater_thread
-        @_updater_thread ||= Contrast::Agent::Thread.new do
+      def start_thread!
+        return if running?
+
+        @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
             begin
-              Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(poll_message)
+              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
             end
             sleep REFRESH_INTERVAL_SEC
           end
         end
       end
-      alias_method :start, :updater_thread
 
       def poll_message
         @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
-
-      def stop
-        Thread.kill(@_updater_thread) if @_updater_thread&.alive?
-      end
     end
   end
 end

data/lib/contrast/agent/static_analysis.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/api/decorators/application_update'
+require 'contrast/components/interface'
+require 'contrast/utils/gemfile_reader'
+require 'contrast/api/decorators/application_update'
 
 module Contrast
   module Agent
@@ -33,7 +33,7 @@ module Contrast
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
 
           Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(app_update_msg)
+          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
         end
       end
     end

data/lib/contrast/agent/thread.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/thread_watcher.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+require 'contrast/agent/service_heartbeat'
+
+module Contrast
+  module Agent
+    # This class used to ensure that our worker threads are running in multi-process environments
+    class ThreadWatcher
+      include Contrast::Components::Interface
+      access_component :logging
+
+      attr_reader :heartbeat
+
+      def initialize
+        @pids = {}
+        @heartbeat = Contrast::Agent::ServiceHeartbeat.new
+      end
+
+      def startup!
+        unless heartbeat.running?
+          logger.debug('Attempting to start heartbeat thread')
+          heartbeat.start_thread!
+        end
+        heartbeat_result = heartbeat.running?
+        logger.debug('Heartbeat thread status', alive: heartbeat_result)
+
+        unless Contrast::Agent.messaging_queue.running?
+          logger.debug('Attempting to start messaging queue thread')
+          Contrast::Agent.messaging_queue.start_thread!
+        end
+        messaging_result = Contrast::Agent.messaging_queue.running?
+        logger.debug('Messaging thread status', alive: messaging_result)
+
+        logger.debug('ThreadWatcher started threads')
+
+        @pids[Process.pid] = messaging_result && heartbeat_result
+      end
+
+      def ensure_running?
+        return if @pids[Process.pid] == true
+
+        logger.debug('ThreadWatcher - threads not running')
+        startup!
+      end
+    end
+  end
+end

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.12.2'
+    VERSION = '3.15.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Base class for threads that do async processing
+    class WorkerThread
+      def initialize
+        @_thread = nil
+      end
+
+      def running?
+        !!@_thread&.alive?
+      end
+
+      def stop!
+        return unless running?
+
+        Thread.kill(@_thread)
+        @_thread = nil
+      end
+    end
+  end
+end

data/lib/contrast/api.rb

@@ -10,9 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm_pb'
-cs__scoped_require 'contrast/api/settings_pb'
-cs__scoped_require 'contrast/api/decorators'
-cs__scoped_require 'contrast/api/unix_socket'
-cs__scoped_require 'contrast/api/tcp_socket'
-cs__scoped_require 'contrast/api/speedracer'
+require 'contrast/api/dtm.pb'
+require 'contrast/api/settings.pb'
+require 'contrast/api/decorators'
+require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to contain all modules that handle communication with speedracer
+    module Communication
+    end
+  end
+end
+
+require 'contrast/api/communication/service_lifecycle'
+require 'contrast/api/communication/connection_status'
+require 'contrast/api/communication/socket'
+require 'contrast/api/communication/tcp_socket'
+require 'contrast/api/communication/unix_socket'
+require 'contrast/api/communication/socket_client'
+require 'contrast/api/communication/messaging_queue'
+require 'contrast/api/communication/response_processor'
+require 'contrast/api/communication/speedracer'