contrast-agent 3.12.2 → 3.15.0

data/lib/contrast/api/communication/tcp_socket.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # This class allows us to create a TCP Socket to communicate to the Service
+      # (Speed Racer). Either it or the Unix Socket will be used, as determined
+      # by the configuration options set for Service communication.
+      class TcpSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :host, :port
+
+        # Create the socket
+        # @param host [String] socket target hostname or IP address
+        # @param port [String,Integer] socket target port
+        def initialize host, port
+          @host = host.to_s
+          @port = port.to_i
+        end
+
+        def new_socket
+          ::TCPSocket.new(host, port)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/unix_socket.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # Implements a UNIX domain socket to connect to the Contrast Service.
+      class UnixSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :path
+
+        # Create the socket
+        # @param path [String] file path to a UNIX domain socket
+        def initialize path
+          @path = path
+        end
+
+        def new_socket
+          ::UNIXSocket.new(path)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators.rb

@@ -8,7 +8,17 @@ module Contrast
     end
   end
 end
-cs__scoped_require 'contrast/api/decorators/application_update'
-cs__scoped_require 'contrast/api/decorators/input_analysis'
-cs__scoped_require 'contrast/api/decorators/application_settings'
-cs__scoped_require 'contrast/api/decorators/server_features'
+require 'contrast/api/decorators/message'
+require 'contrast/api/decorators/application_update'
+require 'contrast/api/decorators/input_analysis'
+require 'contrast/api/decorators/application_settings'
+require 'contrast/api/decorators/server_features'
+require 'contrast/api/decorators/route_coverage'
+require 'contrast/api/decorators/trace_event_object'
+require 'contrast/api/decorators/trace_event_signature'
+require 'contrast/api/decorators/trace_taint_range'
+require 'contrast/api/decorators/trace_event'
+require 'contrast/api/decorators/rasp_rule_sample'
+require 'contrast/api/decorators/user_input'
+require 'contrast/api/decorators/address'
+require 'contrast/api/decorators/http_request'

data/lib/contrast/api/decorators/address.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::Address} protobuf model so it
+      # can own some of the data massaging required for Request dtm. Only works
+      # as an extension of that class.
+      module Address
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :logging
+
+          # receiver is memoized because it is the address/host/port of the server, once we
+          # resolve this for the first time, it shouldn't change
+          #
+          # @return [Contrast::Api::Dtm::Address] the address of this server
+          def build_receiver
+            @_build_receiver ||= begin
+                             address = new
+                             address.host = 'localhost'
+                             address.ip = '127.0.0.1'
+                             begin
+                               Timeout.timeout(1) do
+                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                               end
+                             rescue StandardError => e
+                               logger.warn('Unable to resolve host or ip', e, address: address)
+                             end
+                             address
+                           end
+          end
+
+          # Parse out the sender of the Request and return it as an Address
+          #
+          # @return [Contrast::Api::Dtm::Address] the address from which the
+          #   request originated
+          def build_sender request
+            sender = new
+            sender.ip = Contrast::Utils::StringUtils.force_utf8(request.ip)
+            sender
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Address.include(Contrast::Api::Decorators::Address)

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,14 +1,20 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationSettings protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ApplicationSettings}
+      # protobuf model to handle setting translation.
       module ApplicationSettings
-        MODE_ALLOWLIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        MODE_ALLOWLIST = [
+          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK,
+          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
+        ].cs__freeze
         # Convert protobuf exlcusions into Agent exclusions
         def translated_exclusions
           exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
@@ -25,8 +31,7 @@ module Contrast
           {
               modes_by_id: translated_protection_mode_by_id,
               exclusion_matchers: translated_exclusions,
-              disabled_assess_rules: disabled_assess_rules,
-              session_id: Contrast::Utils::StringUtils.force_utf8(session_id)
+              disabled_assess_rules: disabled_assess_rules
           }
         end
       end

data/lib/contrast/api/decorators/application_update.rb

@@ -1,14 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
-      # AppUpdate dtm
+      # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
+      # model so it can own some of the data massaging required for AppUpdate
+      # dtm.
       module ApplicationUpdate
         include Contrast::Components::Interface
         access_component :config
@@ -17,18 +18,8 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
-        def append_view_technology_descriptor_data view_technology_descriptors
-          view_technology_descriptors.each do |vtd|
-            vtd.technology_names.each do |tech_name|
-              technologies[tech_name] = true
-            end
-          end
-        end
-
-        def append_library_update library_dtm_list, library_tags
-          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+        def append_library_update library_dtm_list
           library_dtm_list.each do |library_dtm|
-            library_dtm.tags = lib_tags
             libraries[library_dtm.hash_code] = library_dtm
           end
         end
@@ -51,10 +42,9 @@ module Contrast
         module ClassMethods
           def build
             msg = new
-            msg.append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies)
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
-            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list)
             msg
           end
         end

data/lib/contrast/api/decorators/http_request.rb

@@ -0,0 +1,140 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/address'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::HttpRequest} protobuf model
+      # so it can own some of the data massaging required for Request dtm. Only
+      # works as an extension of that class.
+      module HttpRequest
+        include Contrast::Components::Interface
+        access_component :agent
+
+        OMITTED_BODY = '{{body-omitted-by-contrast}}'
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Append the sender and receiver to self.
+        #
+        # @param request [Contrast::Agent::Request]
+        def append_addresses request
+          self.sender = Contrast::Api::Dtm::Address.build_sender(request)
+          self.receiver = Contrast::Api::Dtm::Address.build_receiver
+        end
+
+        # Append the connection to self.
+        #
+        # @param request [Contrast::Agent::Request]
+        def append_connection request
+          self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
+          self.version = '1.1' # currently not in rack request; hard-coding
+          self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
+          self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
+        end
+
+        # Append the parameters to self, using the preferred
+        # normalized_request_params field.
+        #
+        # @param request [Contrast::Agent::Request]
+        def append_params request
+          request.parameters.each do |k, v|
+            append_pair(normalized_request_params, k, v)
+          end
+        end
+
+        # Append the normalized headers to self, using the preferred
+        # request_headers field.
+        #
+        # @param request [Contrast::Agent::Request]
+        def append_headers request
+          request.headers.each do |k, v|
+            next unless k && v
+            next if v.is_a?(Hash)
+
+            key = Contrast::Utils::StringUtils.force_utf8(k)
+            val = Contrast::Utils::StringUtils.force_utf8(v)
+            request_headers[key] = val
+          end
+
+          request.cookies.each do |k, v|
+            append_pair(normalized_cookies, k, v)
+          end
+        end
+
+        # Append the body to self, using the preferred
+        # request_body_binary field.
+        #
+        # @param request [Contrast::Agent::Request]
+        def append_body request
+          self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
+
+          self.request_body_binary = if omit_body?(request)
+                                       OMITTED_BODY
+                                     else
+                                       Contrast::Utils::StringUtils.force_utf8(request.body)
+                                     end
+          return if request.file_names.empty?
+
+          request.file_names.each do |name, filename|
+            pair = Contrast::Api::Dtm::SimplePair.new
+            pair.key = Contrast::Utils::StringUtils.force_utf8(name)
+            pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
+            multipart_headers << pair
+          end
+        end
+
+        def omit_body? request
+          return true if AGENT.omit_body?
+          return false if request.document_type != :NORMAL
+
+          request.content_type&.include?('multipart/form-data')
+        end
+
+        def append_pair map, key, value
+          return unless key && value
+          return if value.is_a?(Hash)
+
+          safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+          map[safe_key] ||= Contrast::Api::Dtm::Pair.new
+          map[safe_key].key = safe_key
+          map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :scope
+
+          # Convert our Request into a DTM
+          # @param request [Contrast::Agent::Request]
+          # @return [Contrast::Api::Dtm::HttpRequest]
+          def build request
+            with_contrast_scope do
+              msg = new
+              msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
+              msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
+
+              msg.append_addresses(request)
+              msg.append_connection(request)
+              msg.append_params(request)
+              msg.append_headers(request)
+              msg.append_body(request)
+              msg
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      # Used to decorate the {Contrast::Api::Settings::InputAnalysis} protobuf
+      # model so it can own the request which its data is for.
       module InputAnalysis
         attr_accessor :request
       end

data/lib/contrast/api/decorators/message.rb

@@ -0,0 +1,76 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::Message} protobuf model so it
+      # can handle instance data massaging.
+      module Message
+        include Contrast::Components::Interface
+        access_component :app_context, :logging
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_event event
+          case event
+          when Contrast::Api::Dtm::ServerActivity
+            self.server_activity = event
+          when Contrast::Api::Dtm::AgentStartup
+            self.agent_startup = event
+          when Contrast::Api::Dtm::ApplicationCreate
+            self.application_create = event
+          when Contrast::Api::Dtm::ApplicationUpdate
+            self.application_update = event
+          when Contrast::Api::Dtm::Activity
+            self.activity = event
+          when Contrast::Api::Dtm::HttpRequest
+            self.prefilter = event
+          when Contrast::Api::Dtm::HttpResponse
+            self.postfilter = event
+          when Contrast::Api::Dtm::Poll
+            self.poll = event
+          when Contrast::Api::Dtm::ObservedRoute
+            self.observed_route = event
+          else
+            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
+            return
+          end
+          logger.debug('Wrapping event in message',
+                       msg_id: __id__,
+                       p_id: pid,
+                       msg_count: message_count,
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          @@message_total = 0 # rubocop:disable Style/ClassVars
+          def message_count
+            @@message_total += 1 # rubocop:disable Style/ClassVars
+          end
+
+          def build event
+            msg = new
+            msg.app_name      = APP_CONTEXT.name
+            msg.app_path      = APP_CONTEXT.path
+            msg.app_language  = Contrast::Utils::ObjectShare::RUBY
+            msg.client_id     = APP_CONTEXT.client_id
+            msg.message_count = message_count
+            msg.pid           = APP_CONTEXT.pid
+            msg.ppid          = APP_CONTEXT.ppid
+            msg.append_event(event)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)