contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationSettings protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ApplicationSettings}
+      # protobuf model to handle setting translation.
       module ApplicationSettings
         MODE_ALLOWLIST = [
           Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,

data/lib/contrast/api/decorators/application_update.rb

@@ -1,14 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
-      # AppUpdate dtm
+      # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
+      # model so it can own some of the data massaging required for AppUpdate
+      # dtm.
       module ApplicationUpdate
         include Contrast::Components::Interface
         access_component :config
@@ -17,10 +18,8 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
-        def append_library_update library_dtm_list, library_tags
-          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+        def append_library_update library_dtm_list
           library_dtm_list.each do |library_dtm|
-            library_dtm.tags = lib_tags
             libraries[library_dtm.hash_code] = library_dtm
           end
         end
@@ -45,7 +44,7 @@ module Contrast
             msg = new
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
-            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list)
             msg
           end
         end

data/lib/contrast/api/decorators/http_request.rb

@@ -1,17 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/api/decorators/address'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/address'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the HttpRequest protobuf model so it can own some of
-      # the data massaging required for Request dtm
+      # Used to decorate the {Contrast::Api::Dtm::HttpRequest} protobuf model
+      # so it can own some of the data massaging required for Request dtm. Only
+      # works as an extension of that class.
       module HttpRequest
         include Contrast::Components::Interface
         access_component :agent
@@ -24,7 +25,7 @@ module Contrast
 
         # Append the sender and receiver to self.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_addresses request
           self.sender = Contrast::Api::Dtm::Address.build_sender(request)
           self.receiver = Contrast::Api::Dtm::Address.build_receiver
@@ -32,7 +33,7 @@ module Contrast
 
         # Append the connection to self.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_connection request
           self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
           self.version = '1.1' # currently not in rack request; hard-coding
@@ -43,7 +44,7 @@ module Contrast
         # Append the parameters to self, using the preferred
         # normalized_request_params field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_params request
           request.parameters.each do |k, v|
             append_pair(normalized_request_params, k, v)
@@ -53,7 +54,7 @@ module Contrast
         # Append the normalized headers to self, using the preferred
         # request_headers field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_headers request
           request.headers.each do |k, v|
             next unless k && v
@@ -72,7 +73,7 @@ module Contrast
         # Append the body to self, using the preferred
         # request_body_binary field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_body request
           self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
 

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      # Used to decorate the {Contrast::Api::Settings::InputAnalysis} protobuf
+      # model so it can own the request which its data is for.
       module InputAnalysis
         attr_accessor :request
       end

data/lib/contrast/api/decorators/message.rb

@@ -1,12 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the Message protobuf model so it can handle instance data massaging
+      # Used to decorate the {Contrast::Api::Dtm::Message} protobuf model so it
+      # can handle instance data massaging.
       module Message
         include Contrast::Components::Interface
         access_component :app_context, :logging

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -4,7 +4,8 @@
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the RaspRuleSample protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::RaspRuleSample} protobuf
+      # model.
       module RaspRuleSample
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the RouteCoverage protobuf model to handle conversion between framework route classes
+      # Used to decorate the {Contrast::Api::Dtm::RouteCoverage} protobuf model
+      # to handle conversion between framework route classes and the dtm.
       module RouteCoverage
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/server_features.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ServerFeatures} protobuf
+      # model to handle setting translation to boolean values.
       module ServerFeatures
         # 'defend' is legacy for 'protect' in the dtm.
         def protect_enabled?

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEvent protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEvent} protobuf model to
+      # convert our {Contrast::Agent::AssessContrastEvent} to the dtm.
       module TraceEvent
         def self.included klass
           klass.extend(ClassMethods)
@@ -31,25 +32,40 @@ module Contrast
 
           properties = case taint_target
                        when Contrast::Utils::ObjectShare::OBJECT_KEY
-                         contrast_event.object.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.object)
                        when Contrast::Utils::ObjectShare::RETURN_KEY
-                         contrast_event.ret.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.ret)
                        else
                          target = contrast_event.args[taint_target]
                          if target.is_a?(Hash)
                            if contrast_event.policy_node&.targets&.any?
-                             target[contrast_event.policy_node.targets[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.targets[0]])
                            else
-                             target[contrast_event.policy_node.sources[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.sources[0]])
                            end
                          else
-                           target.cs__properties
+                           Contrast::Agent::Assess::Tracker.properties(target)
                          end
                        end
+          return unless properties.tracked?
 
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+          self.taint_ranges += properties.tags_to_dtm
+        end
+
+        def build_parent_ids contrast_event
+          contrast_event&.parent_events&.each do |event|
+            next unless event
+
+            parent = Contrast::Api::Dtm::ParentObjectId.new
+            parent.id = event.event_id.to_i
+            parent_object_ids << parent
+          end
+        end
 
-          properties.tags_to_dtm
+        def build_stack contrast_event
+          # We delayed doing this as long as possible b/c it's expensive
+          stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+          self.stack += stack_dtms
         end
 
         # Class methods for TraceEvent
@@ -70,23 +86,10 @@ module Contrast
             truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
             event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
             event_dtm.build_event_args(contrast_event, taint_target)
-
-            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
-            taint_ranges.each do |range|
-              event_dtm.taint_ranges << range
-            end
-
-            # We delayed doing this as long as possible b/c it's expensive
-            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
-            event_dtm.stack += stack
-
+            event_dtm.build_parent_ids(contrast_event)
+            event_dtm.build_taint_ranges(contrast_event, taint_target)
+            event_dtm.build_stack(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            contrast_event.parent_ids&.each do |id|
-              parent = Contrast::Api::Dtm::ParentObjectId.new
-              parent.id = id.to_i
-              event_dtm.parent_object_ids << parent
-            end
-
             event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
             event_dtm
           end

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,15 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
+require 'contrast/components/interface'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventObject protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventObject} protobuf
+      # model.
       module TraceEventObject
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,14 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventSignature protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventSignature} protobuf
+      # model.
       module TraceEventSignature
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,13 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceTaintRange protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceTaintRange} protobuf
+      # model.
       module TraceTaintRange
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/user_input.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventObject protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::UserInput} protobuf model.
       module UserInput
         UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
           user_input.input_type = :UNKNOWN

data/lib/contrast/common_agent_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# rubocop:disable Style/MethodMissingSuper, Style/MissingRespondToMissing
+# rubocop:disable Style/MissingRespondToMissing
 module Contrast
   # A wrapper build around the Common Agent Configuration project to allow for
   # access of the values contained in its parent_configuration_spec.yaml
@@ -83,4 +83,4 @@ module Contrast
     end
   end
 end
-# rubocop:enable Style/MethodMissingSuper, Style/MissingRespondToMissing
+# rubocop:enable Style/MissingRespondToMissing

data/lib/contrast/components/agent.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'rubygems/version'
-cs__scoped_require 'contrast/agent/rule_set'
+require 'rubygems/version'
+require 'contrast/agent/rule_set'
 
 module Contrast
   module Components

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'rubygems/version'
+require 'rubygems/version'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Components
@@ -15,7 +16,7 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :agent, :config
+        access_component :agent, :analysis, :config, :logging
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
@@ -28,58 +29,57 @@ module Contrast
 
         def server_type
           @_server_type ||= begin
-                              tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp
-                            end
+            tmp = CONFIG.root.server.type
+            tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp
+          end
         end
 
         def name
           @_name ||= begin
-                       tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
-                     rescue StandardError
-                       DEFAULT_APP_NAME
-                     end
+            tmp = CONFIG.root.application.name
+            tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
+          rescue StandardError
+            DEFAULT_APP_NAME
+          end
         end
 
         def path
           @_path ||= begin
-                       tmp = CONFIG.root.application.path
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
-                     rescue StandardError
-                       DEFAULT_APP_PATH
-                     end
+            tmp = CONFIG.root.application.path
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
+          rescue StandardError
+            DEFAULT_APP_PATH
+          end
         end
 
         def server_name
           @_server_name ||= begin
-                              tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
-                            rescue StandardError
-                              DEFAULT_SERVER_NAME
-                            end
+            tmp = CONFIG.root.server.name
+            tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
+          rescue StandardError
+            DEFAULT_SERVER_NAME
+          end
         end
 
         def server_path
           @_server_path ||= begin
-                              tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
-                            rescue StandardError
-                              DEFAULT_SERVER_PATH
-                            end
+            tmp = CONFIG.root.server.path
+            tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
+          rescue StandardError
+            DEFAULT_SERVER_PATH
+          end
         end
 
         def build_app_startup_message
           msg = Contrast::Api::Dtm::ApplicationCreate.new
 
           msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
-          msg.tags             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
           msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
           msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
           msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
@@ -92,13 +92,24 @@ module Contrast
 
         def build_agent_startup_message
           msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = Contrast::Utils::StringUtils.protobuf_format server_name
-          msg.server_path    = Contrast::Utils::StringUtils.protobuf_format server_path
-          msg.server_type    = Contrast::Utils::StringUtils.protobuf_format server_type
-          msg.server_version = Contrast::Agent::VERSION
-          msg.version        = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
-          msg.environment    = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
-          msg.tags           = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.server_name      = Contrast::Utils::StringUtils.protobuf_format server_name
+          msg.server_path      = Contrast::Utils::StringUtils.protobuf_format server_path
+          msg.server_type      = Contrast::Utils::StringUtils.protobuf_format server_type
+          msg.server_version   = Contrast::Agent::VERSION
+          msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+          msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+          msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+          msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          logger.info('Application context',
+                      server_name: msg.server_name,
+                      server_path: msg.server_path,
+                      server_type: msg.server_type,
+                      application_name: name,
+                      application_path: path,
+                      application_language: Contrast::Utils::ObjectShare::RUBY)
+
           msg
         end