contrast-agent 3.13.2 → 3.14.0

data/lib/contrast/extension/assess/regexp.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -70,7 +70,7 @@ module Contrast
 
           def instrument_regexp_track
             @_instrument_regexp_track ||= begin
-                                               cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
+                                               require 'cs__assess_regexp/cs__assess_regexp'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/string.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/assess/assess_extension'
+require 'contrast/agent/assess/policy/propagation_node'
+require 'contrast/components/interface'
+require 'contrast/extension/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
 # litter our code with Contrast::Utils::DuckUtils.trackable? checks.
@@ -54,7 +54,7 @@ module Contrast
 
           def instrument_string
             @_instrument_string ||= begin
-                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
+                                      require 'cs__assess_string/cs__assess_string'
                                       true
                                     end
           rescue StandardError, LoadError => e
@@ -66,7 +66,7 @@ module Contrast
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
                                                     if AGENT.patch_interpolation? && Funchook.available?
-                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                                                      require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
                                                   rescue StandardError, LoadError => e

data/lib/contrast/extension/inventory.rb

@@ -11,11 +11,11 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/inventory/policy/policy'
-      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+      require 'contrast/agent/inventory/policy/trigger_node'
+      require 'contrast/agent/inventory/policy/policy'
+      require 'contrast/agent/patching/policy/patcher'
     end
   end
 end

data/lib/contrast/extension/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/scope'
+require 'contrast/components/scope'
 
 # This is a reasonable place for the Kernel#catch hook to live.
 # No current plans for component re-design, but if we had some kind of

data/lib/contrast/extension/module.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
+require 'contrast/utils/object_share'
 
 # Some developers override various methods on Module, which can often involve
 # changing expected method parity/behavior which in turn prevents us from being

data/lib/contrast/extension/protect.rb

@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/protect/kernel.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Extension
@@ -30,7 +30,7 @@ module Contrast
 
           def instrument
             @_instrument ||= begin
-                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               require 'cs__protect_kernel/cs__protect_kernel'
                                                true
                                              end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/manager.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/rack/support'
-cs__scoped_require 'contrast/framework/rails/support'
-cs__scoped_require 'contrast/framework/sinatra/support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/framework/platform_version'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/components/interface'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Framework
@@ -128,10 +128,9 @@ module Contrast
       # @param method_name [Symbol] the method to call on each FrameworkSupport class
       # @return [Array]
       def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
+        @_frameworks.flat_map do |framework|
           framework.send(method_name)
         end.compact
-        data
       end
 
       # This returns a single object from the first framework to successfully respond

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rack/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rack/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rack/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/invalid_configuration_util'
+require 'contrast/components/interface'
+require 'contrast/utils/invalid_configuration_util'
 
 module Contrast
   module Framework

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+require 'contrast/framework/rails/patch/assess_configuration'
 module Contrast
   module Framework
     module Rails

data/lib/contrast/framework/rails/patch/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/framework/rails/patch/rails_application_configuration'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework
@@ -20,7 +20,7 @@ module Contrast
             # (i.e., where we normally patch) we will miss the configuration
             # and will never be able to report session misconfiguration rules.
             Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
-            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+            require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
           end
 
           # (See BaseSupport#after_load_patches)

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -17,9 +17,9 @@ module Contrast
             @_instrument ||= begin
                                ::ActionController::Railties::Helpers.class_eval do
                                  alias_method :cs__patched_helper_inherited, :inherited
-                                 def inherited klass
+                                 def inherited klass # rubocop:disable Lint/MissingSuper
                                    klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_helper_inherited(klass)
+                                   cs__patched_helper_inherited(klass) # This calls the original inherited, which should handle super as needed.
                                  ensure
                                    klass&.instance_variable_set(:@cs__defining_class, false)
                                  end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Framework
@@ -58,7 +58,7 @@ module Contrast
 
             def instrument
               @_instrument_named_track ||= begin
-                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                                                 require 'cs__assess_active_record_named/cs__assess_active_record_named'
                                                  true
                                                end
             rescue StandardError, LoadError => e

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -16,9 +16,9 @@ module Contrast
                                  private
 
                                  alias_method :cs__patched_inherited, :inherited
-                                 def inherited klass
+                                 def inherited klass # rubocop:disable Lint/MissingSuper
                                    klass&.instance_variable_set(:@cs__defining_class, true)
-                                   cs__patched_inherited(klass)
+                                   cs__patched_inherited(klass) # This calls the original inherited, which should handle super as needed.
                                  ensure
                                    klass&.instance_variable_set(:@cs__defining_class, false)
                                  end

data/lib/contrast/framework/rails/support.rb

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails/patch/support'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/api/dtm.pb'
+require 'contrast/framework/base_support'
+require 'contrast/framework/rails/patch/support'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Framework
@@ -42,10 +42,7 @@ module Contrast
           end
 
           def collect_routes
-            routes = ::Rails.application.routes.routes.map do |route|
-              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
-            end
-            routes
+            find_all_routes(::Rails.application, [])
           end
 
           def current_route request
@@ -59,13 +56,17 @@ module Contrast
             full_routes = ::Rails.application.routes.router.send(:find_routes, request.rack_request)
             return if full_routes.empty?
 
-            full_route = full_routes[0] # [match_data, path_parameters, route]
-            return unless full_route
-
-            route = full_route[2] # route w/ highest precedence
-            return unless route
+            full_route = full_routes[0]
 
-            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            # the route is directly implemented within the application
+            if direct_route?(full_route)
+              route = full_route[2] # route w/ highest precedence
+              Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+            else
+              engine_route(full_route, request)
+            end
+          rescue StandardError => _e
+            nil
           end
 
           def retrieve_request env
@@ -79,6 +80,53 @@ module Contrast
 
             env[AC_INSTANCE].cs__class.included_modules.include?(::ActionController::Live)
           end
+
+          private
+
+          # route is not mounted within an engine
+          def direct_route? full_route
+            full_route[2]&.app&.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher ||
+                (full_route[2].cs__class == ActionDispatch::Journey::Route && full_route[2]&.app&.cs__class == ActionDispatch::Routing::Mapper::Constraints)
+          end
+
+          def engine_route full_route, request
+            engine_route = full_route[2] # supposed route - but actually an Engine mount point
+            return unless engine_route
+
+            engine_mount_name = engine_route.name
+            return unless engine_mount_name
+
+            engine_path_segments = request.rack_request.path_info.split(engine_mount_name)
+            return if engine_path_segments.empty?
+
+            path_within_engine = engine_path_segments[-1]
+            return unless path_within_engine
+
+            engine_router = engine_route.app&.app&.routes&.router
+            return unless engine_router
+
+            # Get all routes regardless of http method
+            matching_routes = engine_router.send(:filter_routes, path_within_engine)
+            return unless matching_routes
+
+            # filter for current http method
+            reportable_routes = engine_router.send(:match_routes, matching_routes, request.rack_request)
+            return if reportable_routes.empty?
+
+            Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(reportable_routes[0])
+          end
+
+          # Rails engine routes need to be detected by inspecting Engine class route set
+          def find_all_routes app, route_list
+            app.routes.routes.each do |route|
+              if route.cs__respond_to?(:app) && route.app.cs__class == ActionDispatch::Routing::RouteSet::Dispatcher
+                route_list << Contrast::Api::Dtm::RouteCoverage.from_action_dispatch_journey(route)
+              elsif route.app.app.cs__respond_to?(:routes)
+                route_list += find_all_routes(route.app.app, [])
+              end
+            end
+            route_list
+          end
         end
       end
     end

data/lib/contrast/framework/sinatra/patch/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/sinatra/support'
+require 'contrast/framework/sinatra/support'
 
 module Contrast
   module Framework

data/lib/contrast/framework/sinatra/patch/support.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
 
 module Contrast
   module Framework

data/lib/contrast/framework/sinatra/support.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/sinatra/patch/support'
+require 'contrast/framework/base_support'
+require 'contrast/framework/sinatra/patch/support'
 
 module Contrast
   module Framework

data/lib/contrast/funchook/funchook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 # This module is used to find funchook library and determine availability
 module Funchook
   include Contrast::Components::Interface

data/lib/contrast/logger/application.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Logger
-    # # Our decorator for the Ougai logger allowing for the logging of the
+    # Our decorator for the Ougai logger allowing for the logging of the
     # application environment, used to provide context during troubleshooting.
     module Application
       include Contrast::Components::Interface

data/lib/contrast/logger/format.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ougai'
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'ougai'
+require 'contrast/utils/object_share'
+require 'contrast/utils/thread_tracker'
 
 module Contrast
   module Logger
@@ -31,21 +32,33 @@ module Contrast
 
       private
 
-      # The extra values to add to the Bunyan hash. Because this is unique per
-      # thread, we'll create it once and then store it, rather than create a
-      # new hash on every log call.
+      # The extra values to add to the Bunyan hash.
       # @return [Hash{Symbol => Object}] the extra data to log
-      #   tid: current thread id
       def format_hash
-        hash = LOG_TRACKER.get(:thread_id_hash)
+        thread_hash.merge(request_hash)
+      end
+
+      # Because this is unique per thread, we'll create it once and then store
+      # it, rather than create a new hash on every log call during the request.
+      def thread_hash
+        hash = LOG_TRACKER.get(:logging_hash)
         unless hash
           hash = {
-              tid: Thread.current.object_id
+              thread_id: Thread.current.object_id
           }
-          LOG_TRACKER.set(:thread_id_hash, hash)
+          LOG_TRACKER.set(:logging_hash, hash)
         end
         hash
       end
+
+      NO_REQUEST_HASH = { request_id: -1 }.cs__freeze
+      def request_hash
+        @request_tracker_defined ||= defined?(Contrast::Agent) &&
+            defined?(Contrast::Agent::REQUEST_TRACKER)
+        return NO_REQUEST_HASH unless @request_tracker_defined
+
+        Contrast::Agent::REQUEST_TRACKER&.current&.logging_hash || NO_REQUEST_HASH
+      end
     end
   end
 end