contrast-agent 3.13.1 → 4.0.0

data/lib/contrast/framework/rails/support.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails/patch/support'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/api/dtm.pb'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rails/patch/support'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Framework
@@ -42,12 +42,12 @@ module Contrast
           end
 
           def collect_routes
-            routes = ::Rails.application.routes.routes.map do |route|
-              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
-            end
-            routes
+            find_all_routes(::Rails.application, [])
           end
 
+          # Find the current route, based on the provided Request wrapper
+          # @param request[Contrast::Agent::Request]
+          # @return [Contrast::Api::Dtm::RouteCoverage]
           def current_route request
             return unless ::Rails.cs__respond_to?(:application)
 
@@ -59,13 +59,17 @@ module Contrast
             full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
             return if full_routes.empty?
 
-            full_route = full_routes[0] # [match_data, path_parameters, route]
-            return unless full_route
-
-            route = full_route[2] # route w/ highest precedence
-            return unless route
+            full_route = full_routes[0]
 
-            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            # the route is directly implemented within the application
+            if direct_route?(full_route)
+              route = full_route[2] # route w/ highest precedence
+              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            else
+              engine_route(full_route, request)
+            end
+          rescue StandardError => _e
+            nil
           end
 
           def retrieve_request env
@@ -79,6 +83,55 @@ module Contrast
 
             env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
           end
+
+          private
+
+          # route is not mounted within an engine
+          def direct_route? full_route
+            full_route[2]&.app&.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher ||
+                (full_route[2].cs__class == ActionDispatch::Journey::Route && full_route[2]&.app&.cs__class == ActionDispatch::Routing::Mapper::Constraints)
+          end
+
+          def engine_route full_route, request
+            engine_route = full_route[2] # supposed route - but actually an Engine mount point
+            return unless engine_route
+
+            engine_mount_name = engine_route.name
+            return unless engine_mount_name
+
+            engine_path_segments = request.rack_request.path_info.split(engine_mount_name)
+            return if engine_path_segments.empty?
+
+            path_within_engine = engine_path_segments[-1]
+            return unless path_within_engine
+
+            engine_router = engine_route.app&.app&.routes&.router
+            return unless engine_router
+
+            # Get all routes regardless of http method
+            matching_routes = engine_router.send(:filter_routes, path_within_engine)
+            return unless matching_routes
+
+            # filter for current http method
+            reportable_routes = engine_router.send(:match_routes, matching_routes, request.rack_request)
+            return if reportable_routes.empty?
+
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(reportable_routes[0])
+          end
+
+          # Rails engine routes need to be detected by inspecting Engine class route set
+          def find_all_routes app, route_list
+            return route_list unless app.cs__respond_to?(:routes) && app.routes.cs__respond_to?(:routes)
+
+            app.routes.routes.each do |route|
+              if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
+                route_list << Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+              elsif route.app.app.cs__respond_to?(:routes)
+                route_list += find_all_routes(route.app.app, [])
+              end
+            end
+            route_list
+          end
         end
       end
     end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/sinatra/support'
+require 'contrast/framework/sinatra/support'
 
 module Contrast
   module Framework
@@ -34,17 +34,17 @@ module Contrast
 
             def instrument
               @_instrument ||= begin
-                                ::Sinatra::Base.class_eval do
-                                  alias_method :cs__patched_sinatra_base_call!, :call!
-                                  # publicly available method for Sinatra::Base things -- unfortunately,
-                                  # getting the routes appear to require a lookup every time
-                                  def call! *args
-                                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
-                                    cs__patched_sinatra_base_call!(*args)
-                                  end
-                                end
-                                true
-                              end
+                ::Sinatra::Base.class_eval do
+                  alias_method :cs__patched_sinatra_base_call!, :call!
+                  # publicly available method for Sinatra::Base things -- unfortunately,
+                  # getting the routes appear to require a lookup every time
+                  def call! *args
+                    Contrast::Framework::Sinatra::Patch::Base.map_route(cs__class, settings, *args)
+                    cs__patched_sinatra_base_call!(*args)
+                  end
+                end
+                true
+              end
             end
 
             private

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/sinatra/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/sinatra/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
   module Framework
@@ -70,10 +70,10 @@ module Contrast
             return nil unless defined?(::Sinatra) && defined?(::Sinatra::Base)
 
             @_app_class ||= begin
-                              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
-                              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-                              result_layer
-                            end
+              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+              result_layer = sinatra_layers.find { |layer| layer.app.nil? }
+              result_layer
+            end
           end
 
           # Iterate over every class that extends Sinatra::Base, pull out its routes

data/lib/contrast/funchook/funchook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 # This module is used to find funchook library and determine availability
 module Funchook
   include Contrast::Components::Interface

data/lib/contrast/logger/application.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Logger
-    # # Our decorator for the Ougai logger allowing for the logging of the
+    # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
       include Contrast::Components::Interface
@@ -33,9 +33,17 @@ module Contrast
       def application_configuration
         return unless info?
 
-        loggable = CONFIG.raw.send(:load_config)
-        loggable.delete('api')
-        info('Current configuration', configuration: JSON.pretty_generate(loggable))
+        loggable = CONFIG.loggable
+        info('Current configuration', configuration: loggable)
+        env_keys = ENV.keys.select { |env_key| env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) }
+        env_items = env_keys.map { |env_key| Contrast::Utils::EnvConfigurationItem.new(env_key, nil) }
+        env_translations = env_items.each_with_object({}) do |conversion, hash|
+          hash[conversion.key] = conversion.dot_path_array.join('.')
+        end
+        info('Set by environment', overrides: env_translations)
+      rescue StandardError => e
+        puts e
+        sleep(5)
       end
 
       def application_libraries

data/lib/contrast/logger/format.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ougai'
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'ougai'
+require 'contrast/utils/object_share'
+require 'contrast/utils/thread_tracker'
 
 module Contrast
   module Logger
@@ -31,21 +32,33 @@ module Contrast
 
       private
 
-      # The extra values to add to the Bunyan hash. Because this is unique per
-      # thread, we'll create it once and then store it, rather than create a
-      # new hash on every log call.
+      # The extra values to add to the Bunyan hash.
       # @return [Hash{Symbol => Object}] the extra data to log
-      #   tid: current thread id
       def format_hash
-        hash = LOG_TRACKER.get(:thread_id_hash)
+        thread_hash.merge(request_hash)
+      end
+
+      # Because this is unique per thread, we'll create it once and then store
+      # it, rather than create a new hash on every log call during the request.
+      def thread_hash
+        hash = LOG_TRACKER.get(:logging_hash)
         unless hash
           hash = {
-              tid: Thread.current.object_id
+              thread_id: Thread.current.object_id
           }
-          LOG_TRACKER.set(:thread_id_hash, hash)
+          LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
       end
+
+      NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
+      def request_hash
+        @request_tracker_defined ||= defined?(Contrast::Agent) &&
+            defined?(Contrast::Agent::REQUEST_TRACKER)
+        return NO_REQUEST_HASH unless @request_tracker_defined
+
+        Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH
+      end
     end
   end
 end

data/lib/contrast/logger/log.rb

@@ -1,15 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'logger'
-cs__scoped_require 'ougai'
-cs__scoped_require 'singleton'
+require 'logger'
+require 'ougai'
+require 'singleton'
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/logger/application'
-cs__scoped_require 'contrast/logger/format'
-cs__scoped_require 'contrast/logger/time'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
+require 'contrast/logger/application'
+require 'contrast/logger/format'
+require 'contrast/logger/request'
+require 'contrast/logger/time'
 
 module Contrast
   module Logger
@@ -48,14 +49,19 @@ module Contrast
         path        = valid_path(config_path   || log_file)
         level_const = valid_level(config_level || log_level)
 
+        path_change = path != previous_path
+        level_change = level_const != previous_level
+
         # don't needlessly recreate logger
-        return if @_logger && (path == previous_path) && (level_const == previous_level)
+        return if @_logger && !(path_change || level_change)
 
         @previous_path  = path
         @previous_level = level_const
 
         @_logger = build(path: path, level_const: level_const)
-        log_update
+        # If we're logging to a new path, then let's start it w/ our helpful
+        # data gathering messages
+        log_update if path_change
       rescue StandardError => e
         if logger
           logger.error('Unable to process update to LoggerManager.', e)
@@ -98,6 +104,7 @@ module Contrast
 
       def add_contrast_loggers logger
         logger.extend(Contrast::Logger::Application)
+        logger.extend(Contrast::Logger::Request)
         logger.extend(Contrast::Logger::Time)
       end
 

data/lib/contrast/logger/request.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/interface'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for the logging of the
+    # request lifecycle, used to provide context during troubleshooting.
+    module Request
+      include Contrast::Components::Interface
+      access_component :config
+
+      # Utility method to log the start of a request
+      def request_start
+        debug('Beginning request analysis')
+      end
+
+      # Utility method to log the end of a request, including the time it took
+      # for that request to be processed.
+      def request_end
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        elapsed_time = context ? (Contrast::Utils::Timer.now_ms - context.timer.start_ms) : -1
+        debug('Ending request analysis',
+              elapsed_time_ms: elapsed_time)
+      end
+    end
+  end
+end

data/lib/contrast/tasks/config.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'yaml'
+require 'yaml'
 
 module Contrast
   # A Rake task to generate a contrast_security.yaml file with some basic settings

data/lib/contrast/tasks/service.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/os'
+require 'contrast/components/interface'
+require 'contrast/utils/os'
 
 module Contrast
   # A Rake task designed to allow control of the Contrast Service as a stand

data/lib/contrast/utils/assess/sampling_util.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'singleton'
-cs__scoped_require 'contrast/components/interface'
+require 'singleton'
+require 'contrast/components/interface'
 
 module Contrast
   module Utils

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,7 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/tracker'
+require 'contrast/components/interface'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Utils
@@ -23,6 +25,16 @@ module Contrast
             _tracked?(obj, 0)
           end
 
+          # Public interface to our tracking check, isolating the internals
+          # required for recursion.
+          #
+          # @param obj [Object] the thing to check if tracked
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   tracked.
+          def trackable? obj
+            _trackable?(obj, 0)
+          end
+
           private
 
           # Sometimes things are nested inside of each other, such as an Array
@@ -49,10 +61,8 @@ module Contrast
               obj.any? do |ele|
                 _tracked?(ele, idx) unless obj == ele
               end
-            elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
-              obj.cs__tracked?
             else
-              false
+              Contrast::Agent::Assess::Tracker.tracked?(obj)
             end
           rescue StandardError => e
             # This is used to ask if a ton of objects are tracked. They may not
@@ -61,6 +71,41 @@ module Contrast
             logger.warn('Failed to determine tracking', e, module: obj.cs__class)
             false
           end
+
+          # Sometimes things are nested inside of each other, such as an Array
+          # holding a Hash, holding that Array. In those cases, rather than
+          # entering an infinite loop, we'll break out.
+          # Right now, that level of nesting has been arbitrarily set to 10.
+          #
+          # @param obj [Object] the thing to check if trackable
+          # @param idx [Integer] the number of levels nested we've gone
+          # @return [Boolean] if the obj, or something in it if a collection, is
+          #   trackable.
+          def _trackable? obj, idx
+            return false if obj.nil?
+            return false if idx > 10
+
+            idx += 1
+            if Contrast::Utils::DuckUtils.iterable_hash?(obj)
+              obj.each_pair do |k, v|
+                return true if _trackable?(k, idx)
+                return true if _trackable?(v, idx)
+              end
+              false
+            elsif Contrast::Utils::DuckUtils.iterable_enumerable?(obj)
+              obj.any? do |ele|
+                _trackable?(ele, idx) unless obj == ele
+              end
+            else
+              Contrast::Agent::Assess::Tracker.trackable?(obj)
+            end
+          rescue StandardError => e
+            # This is used to ask if a ton of objects are tracked. They may not
+            # all be iterable. Bad things could happen in some cases, like when
+            # checking a closed statement for SQL injection trigger events
+            logger.warn('Failed to determine trackable', e, module: obj.cs__class)
+            false
+          end
         end
       end
     end