contrast-agent 3.13.0 → 3.16.0

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+require 'contrast/framework/rails/patch/assess_configuration'
 module Contrast
   module Framework
     module Rails
@@ -13,16 +13,16 @@ module Contrast
         class RailsApplicationConfiguration
           def self.instrument
             @_instrument ||= begin
-                               ::Rails::Application::Configuration.class_eval do
-                                 alias_method :cs__patched_session_store, :session_store
-                                 def session_store *args
-                                   ret = cs__patched_session_store(*args)
-                                   Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
-                                   ret
-                                 end
-                               end
-                               true
-                             end
+              ::Rails::Application::Configuration.class_eval do
+                alias_method :cs__patched_session_store, :session_store
+                def session_store *args
+                  ret = cs__patched_session_store(*args)
+                  Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                  ret
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework
@@ -11,7 +11,7 @@ module Contrast
         # Extension point allowing for the registration of Patches required to
         # support the Rails framework.
         module Support
-          # (See BaseSupport#before_load_patches)
+          # (See BaseSupport#before_load_patches!)
           def before_load_patches!
             return unless defined?(::Rails)
 
@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -15,17 +15,17 @@ module Contrast
         class ActionControllerRailtiesHelperInherited
           def self.instrument
             @_instrument ||= begin
-                               ::ActionController::Railties::Helpers.class_eval do
-                                 alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass
-                                   klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass)
-                                 ensure
-                                   klass&.instance_variable_set(:@cs__defining_class, false)
-                                 end
-                               end
-                               true
-                             end
+              ::ActionController::Railties::Helpers.class_eval do
+                alias_method :cs__patched_helper_inherited, :inherited
+                def inherited klass # rubocop:disable Lint/MissingSuper
+                  klass&.instance_variable_set(:@cs__defining_class, true)
+                  cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                ensure
+                  klass&.instance_variable_set(:@cs__defining_class, false)
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -17,20 +17,20 @@ module Contrast
         class ActiveRecordAttributeMethodsRead
           def self.instrument
             @_instrument ||= begin
-                           ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
-                             alias_method :cs__patched_define_method_attribute, :define_method_attribute
+              ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
+                alias_method :cs__patched_define_method_attribute, :define_method_attribute
 
-                             def define_method_attribute *args, &block
-                               ret = cs__patched_define_method_attribute(*args, &block)
-                               method_name = args[0]
-                               Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-                               ret
-                             end
+                def define_method_attribute *args, &block
+                  ret = cs__patched_define_method_attribute(*args, &block)
+                  method_name = args[0]
+                  Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+                  ret
+                end
 
-                             protected :cs__patched_define_method_attribute, :define_method_attribute
-                           end
-                           true
-                         end
+                protected :cs__patched_define_method_attribute, :define_method_attribute
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -58,9 +58,9 @@ module Contrast
 
             def instrument
               @_instrument_named_track ||= begin
-                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
-                                                 true
-                                               end
+                require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                true
+              end
             rescue StandardError, LoadError => e
               logger.error('Error loading active record named track patch', e)
               false

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -12,19 +12,19 @@ module Contrast
         class ActiveRecordTimeZoneInherited
           def self.instrument
             @_instrument ||= begin
-                               ::ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods.class_eval do
-                                 private
+              ::ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods.class_eval do
+                private
 
-                                 alias_method :cs__patched_inherited, :inherited
-                                 def inherited klass
-                                   klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_inherited(klass)
-                                 ensure
-                                   klass&.instance_variable_set(:@cs__defining_class, false)
-                                 end
-                               end
-                               true
-                             end
+                alias_method :cs__patched_inherited, :inherited
+                def inherited klass # rubocop:disable Lint/MissingSuper
+                  klass&.instance_variable_set(:@cs__defining_class, true)
+                  cs__patched_inherited(klass) # This calls the original inherited, which should handle super as needed.
+                ensure
+                  klass&.instance_variable_set(:@cs__defining_class, false)
+                end
+              end
+              true
+            end
           end
         end
       end

data/lib/contrast/framework/rails/support.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails/patch/support'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/api/dtm.pb'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rails/patch/support'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Framework
@@ -42,10 +42,7 @@ module Contrast
           end
 
           def collect_routes
-            routes = ::Rails.application.routes.routes.map do |route|
-              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
-            end
-            routes
+            find_all_routes(::Rails.application, [])
           end
 
           def current_route request
@@ -59,13 +56,17 @@ module Contrast
             full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
             return if full_routes.empty?
 
-            full_route = full_routes[0] # [match_data, path_parameters, route]
-            return unless full_route
-
-            route = full_route[2] # route w/ highest precedence
-            return unless route
+            full_route = full_routes[0]
 
-            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            # the route is directly implemented within the application
+            if direct_route?(full_route)
+              route = full_route[2] # route w/ highest precedence
+              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            else
+              engine_route(full_route, request)
+            end
+          rescue StandardError => _e
+            nil
           end
 
           def retrieve_request env
@@ -79,6 +80,55 @@ module Contrast
 
             env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
           end
+
+          private
+
+          # route is not mounted within an engine
+          def direct_route? full_route
+            full_route[2]&.app&.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher ||
+                (full_route[2].cs__class == ActionDispatch::Journey::Route && full_route[2]&.app&.cs__class == ActionDispatch::Routing::Mapper::Constraints)
+          end
+
+          def engine_route full_route, request
+            engine_route = full_route[2] # supposed route - but actually an Engine mount point
+            return unless engine_route
+
+            engine_mount_name = engine_route.name
+            return unless engine_mount_name
+
+            engine_path_segments = request.rack_request.path_info.split(engine_mount_name)
+            return if engine_path_segments.empty?
+
+            path_within_engine = engine_path_segments[-1]
+            return unless path_within_engine
+
+            engine_router = engine_route.app&.app&.routes&.router
+            return unless engine_router
+
+            # Get all routes regardless of http method
+            matching_routes = engine_router.send(:filter_routes, path_within_engine)
+            return unless matching_routes
+
+            # filter for current http method
+            reportable_routes = engine_router.send(:match_routes, matching_routes, request.rack_request)
+            return if reportable_routes.empty?
+
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(reportable_routes[0])
+          end
+
+          # Rails engine routes need to be detected by inspecting Engine class route set
+          def find_all_routes app, route_list
+            return route_list unless app.cs__respond_to?(:routes) && app.routes.cs__respond_to?(:routes)
+
+            app.routes.routes.each do |route|
+              if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
+                route_list << Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+              elsif route.app.app.cs__respond_to?(:routes)
+                route_list += find_all_routes(route.app.app, [])
+              end
+            end
+            route_list
+          end
         end
       end
     end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/sinatra/support'
+require 'contrast/framework/sinatra/support'
 
 module Contrast
   module Framework
@@ -34,17 +34,17 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                ::Sinatra::Base.class_eval do
-                                  alias_method :cs__patched_sinatra_base_call!, :call!
-                                  # publicly available method for Sinatra::Base things -- unfortunately,
-                                  # getting the routes appear to require a lookup every time
-                                  def call! *args
-                                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
-                                    cs__patched_sinatra_base_call!(*args)
-                                  end
-                                end
-                                true
-                              end
+                ::Sinatra::Base.class_eval do
+                  alias_method :cs__patched_sinatra_base_call!, :call!
+                  # publicly available method for Sinatra::Base things -- unfortunately,
+                  # getting the routes appear to require a lookup every time
+                  def call! *args
+                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
+                    cs__patched_sinatra_base_call!(*args)
+                  end
+                end
+                true
+              end
             end
 
             private

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/sinatra/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/sinatra/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
   module Framework
@@ -70,10 +70,10 @@ module Contrast
             return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
 
             @_app_class ||= begin
-                              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
-                              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-                              result_layer
-                            end
+              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+              result_layer
+            end
           end
 
           # Iterate over every class that extends Sinatra::Base, pull out its routes

data/lib/contrast/funchook/funchook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 # This module is used to find funchook library and determine availability
 module Funchook
   include Contrast::Components::Interface

data/lib/contrast/logger/application.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Logger
-    # # Our decorator for the Ougai logger allowing for the logging of the
+    # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
       include Contrast::Components::Interface
@@ -33,9 +33,17 @@ module Contrast
       def application_configuration
         return unless info?
 
-        loggable = CONFIG.raw.send(:load_config)
-        loggable.delete('api')
-        info('Current configuration', configuration: JSON.pretty_generate(loggable))
+        loggable = CONFIG.raw.loggable
+        info('Current configuration', configuration: loggable)
+        env_keys = ENV.keys.select { |env_key| env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) }
+        env_items = env_keys.map { |env_key| Contrast::Utils::EnvConfigurationItem.new(env_key, nil) }
+        env_translations = env_items.each_with_object({}) do |conversion, hash|
+          hash[conversion.key] = conversion.dot_path_array.join('.')
+        end
+        info('Set by environment', overrides: env_translations)
+      rescue StandardError => e
+        puts e
+        sleep(5)
       end
 
       def application_libraries

data/lib/contrast/logger/format.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ougai'
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'ougai'
+require 'contrast/utils/object_share'
+require 'contrast/utils/thread_tracker'
 
 module Contrast
   module Logger
@@ -31,21 +32,33 @@ module Contrast
 
       private
 
-      # The extra values to add to the Bunyan hash. Because this is unique per
-      # thread, we'll create it once and then store it, rather than create a
-      # new hash on every log call.
+      # The extra values to add to the Bunyan hash.
       # @return [Hash{Symbol => Object}] the extra data to log
-      #   tid: current thread id
       def format_hash
-        hash = LOG_TRACKER.get(:thread_id_hash)
+        thread_hash.merge(request_hash)
+      end
+
+      # Because this is unique per thread, we'll create it once and then store
+      # it, rather than create a new hash on every log call during the request.
+      def thread_hash
+        hash = LOG_TRACKER.get(:logging_hash)
         unless hash
           hash = {
-              tid: Thread.current.object_id
+              thread_id: Thread.current.object_id
           }
-          LOG_TRACKER.set(:thread_id_hash, hash)
+          LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
       end
+
+      NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
+      def request_hash
+        @request_tracker_defined ||= defined?(Contrast::Agent) &&
+            defined?(Contrast::Agent::REQUEST_TRACKER)
+        return NO_REQUEST_HASH unless @request_tracker_defined
+
+        Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH
+      end
     end
   end
 end