contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/cmd_injection.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/utils/stack_trace_utils'
+require 'contrast/utils/object_share'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/components/interface'
+require 'contrast/utils/stack_trace_utils'
 
 module Contrast
   module Agent
@@ -52,8 +52,7 @@ module Contrast
           def find_attacker context, path
             attack_result = nil
             attack_result = super(context, path) if infilter?(context)
-            attack_result = check_rep_features(context, path, attack_result)
-            attack_result
+            check_rep_features(context, path, attack_result)
           end
 
           # Build a subclass of the RaspRuleSample using the query string and the

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/agent/protect/policy/applies_sqli_rule'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/policy/applies_sqli_rule'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -50,14 +50,12 @@ module Contrast
             # string to the end of the last entity declaration.
             xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx])
             ia_result = build_evaluation(xxe_details.xml)
-            result = build_attack_with_match(
+            build_attack_with_match(
                 context,
                 ia_result,
                 nil,
                 nil,
                 details: xxe_details)
-
-            result
           end
 
           def build_details xml, _evaluation = nil

data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb

@@ -27,14 +27,14 @@ module Contrast
             end
 
             # <!ENTITY name SYSTEM "URI">
-            SYSTEM_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+SYSTEM\s+"(?<id>.*?)">/.cs__freeze
+            SYSTEM_ID_REGEXP = /<!ENTITY\s+(?<name>[a-zA-Z0-f]+)\s+SYSTEM\s+"(?<id>.*?)">/.cs__freeze
             def parse_system_id entity
               match = SYSTEM_ID_REGEXP.match(entity)
               match[:id] if match
             end
 
             # <!ENTITY name PUBLIC "public_ID" "URI">
-            PUBLIC_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+PUBLIC\s+".*?"\s+"(?<id>.*?)">/.cs__freeze
+            PUBLIC_ID_REGEXP = /<!ENTITY\s+(?<name>[a-zA-Z0-f]+)\s+PUBLIC\s+".*?"\s+"(?<id>.*?)">/.cs__freeze
             def parse_public_id entity
               match = PUBLIC_ID_REGEXP.match(entity)
               match[:id] if match

data/lib/contrast/agent/railtie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/job_servers_running'
+require 'contrast/utils/job_servers_running'
 
 module Contrast
   module Agent

data/lib/contrast/agent/reaction_processor.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/disable_reaction'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/disable_reaction'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/request.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -21,8 +21,8 @@ module Contrast
 
       extend Forwardable
 
-      INNER_REST_TOKEN = %r{/[\d]+/}.cs__freeze
-      LAST_REST_TOKEN = %r{/[\d]+$}.cs__freeze
+      INNER_REST_TOKEN = %r{/\d+/}.cs__freeze
+      LAST_REST_TOKEN = %r{/\d+$}.cs__freeze
       INNER_NUMBER_MARKER = '/{n}/'
       LAST_NUMBER_MARKER = '/{n}'
 
@@ -168,7 +168,9 @@ module Contrast
         # (rather than breaking this out into two methods)
         case val
         when Tempfile
-          { prefix => Contrast::Utils::StringUtils.force_utf8(val.path) }
+          # Skip if it's the auto-generated value from rails when it handles
+          # file uploads. The file name will still be sent to SR for analysis.
+          {}
         when Hash
           res = val.each_with_object({}) do |(k, v), hash|
             k = Contrast::Utils::StringUtils.force_utf8(k)

data/lib/contrast/agent/request_context.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/inventory_util'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/timer'
+require 'contrast/agent/request'
+require 'contrast/agent/response'
+require 'contrast/utils/inventory_util'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -19,6 +19,7 @@ module Contrast
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
 
       attr_reader :timer,
+                  :logging_hash,
                   :speedracer_input_analysis,
                   :request,
                   :response,
@@ -29,8 +30,11 @@ module Contrast
 
       def initialize rack_request, app_loaded = true
         with_contrast_scope do
-          # all requests get a timer
+          # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new
+          @logging_hash = {
+              request_id: __id__
+          }
 
           # instantiate helper for request and response
           @request = Contrast::Agent::Request.new(rack_request)

data/lib/contrast/agent/response.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/rewriter.rb

@@ -3,10 +3,10 @@
 
 # intentional -- we're using a << operator here
 
-cs__scoped_require 'contrast/agent/class_reopener'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/ruby_ast_rewriter'
+require 'contrast/agent/class_reopener'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/components/interface'
+require 'contrast/utils/ruby_ast_rewriter'
 
 module Contrast
   module Agent
@@ -163,8 +163,7 @@ module Contrast
 
         def rewrite_method original_source_code
           new_code = rewrite(original_source_code)
-          new_code = remove_self_definition(new_code)
-          new_code
+          remove_self_definition(new_code)
         end
 
         def rewrite source

data/lib/contrast/agent/service_heartbeat.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/worker_thread'
+require 'contrast/components/interface'
+require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent

data/lib/contrast/agent/static_analysis.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/api/decorators/application_update'
+require 'contrast/components/interface'
+require 'contrast/utils/gemfile_reader'
+require 'contrast/api/decorators/application_update'
 
 module Contrast
   module Agent

data/lib/contrast/agent/thread.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/thread_watcher.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/service_heartbeat'
+require 'contrast/components/interface'
+require 'contrast/agent/service_heartbeat'
 
 module Contrast
   module Agent

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.13.2'
+    VERSION = '3.14.0'
   end
 end

data/lib/contrast/api.rb

@@ -10,7 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/api/settings.pb'
-cs__scoped_require 'contrast/api/decorators'
-cs__scoped_require 'contrast/api/communication'
+require 'contrast/api/dtm.pb'
+require 'contrast/api/settings.pb'
+require 'contrast/api/decorators'
+require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -9,12 +9,12 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/communication/service_lifecycle'
-cs__scoped_require 'contrast/api/communication/connection_status'
-cs__scoped_require 'contrast/api/communication/socket'
-cs__scoped_require 'contrast/api/communication/tcp_socket'
-cs__scoped_require 'contrast/api/communication/unix_socket'
-cs__scoped_require 'contrast/api/communication/socket_client'
-cs__scoped_require 'contrast/api/communication/messaging_queue'
-cs__scoped_require 'contrast/api/communication/response_processor'
-cs__scoped_require 'contrast/api/communication/speedracer'
+require 'contrast/api/communication/service_lifecycle'
+require 'contrast/api/communication/connection_status'
+require 'contrast/api/communication/socket'
+require 'contrast/api/communication/tcp_socket'
+require 'contrast/api/communication/unix_socket'
+require 'contrast/api/communication/socket_client'
+require 'contrast/api/communication/messaging_queue'
+require 'contrast/api/communication/response_processor'
+require 'contrast/api/communication/speedracer'

data/lib/contrast/api/communication/messaging_queue.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/worker_thread'
+require 'contrast/components/interface'
+require 'contrast/agent/worker_thread'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/response_processor.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/reaction_processor'
+require 'contrast/agent/reaction_processor'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/socket_client.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'socket'
-cs__scoped_require 'uri'
+require 'socket'
+require 'uri'
 
-cs__scoped_require 'contrast/api/communication/tcp_socket'
-cs__scoped_require 'contrast/api/communication/unix_socket'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/api/communication/tcp_socket'
+require 'contrast/api/communication/unix_socket'
+require 'contrast/components/interface'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/speedracer.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Api