contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,104 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Interface
+        include Contrast::Agent::Inventory::Dependencies
+
+        access_component :analysis, :config, :logging
+
+        def initialize
+          return unless enabled?
+
+          @gemdigest_cache = Contrast::Agent::Inventory::GemfileDigestCache.new
+        end
+
+        # This method is invoked once, along with the rest of our catchup code
+        # to report libraries and their associated files that have already been loaded pre-contrast
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            @gemdigest_cache.use_cache(digest) do |existing_files|
+              loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+              loaded_files_from_gem.each do |file_path|
+                logger.trace('Recording loaded file for inventory analysis', line: file_path)
+                existing_files << adjust_path_for_reporting(file_path, spec)
+              end
+            end
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific
+        # file being required to the gem it belongs to
+        #
+        # @param path [String] the result of TracePoint#path from the :end
+        #   event in which the Module was defined
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @gemdigest_cache.get(digest) << report_path
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages filed of the Activity message using the
+        # data stored in the @gemdigest_cache
+        #
+        # @param activity [Contrast::Api::Dtm::Activity] the message to which
+        #   to append the usage data
+        def generate_library_usage activity
+          return unless enabled?
+          return if @gemdigest_cache.empty?
+
+          @gemdigest_cache.generate_usage_data(activity)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..-1] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/gemfile_digest_cache.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # Keeps a map of gem digest to files for reporting file usage
+      class GemfileDigestCache
+        extend Forwardable
+        def_delegator :@gem_spec_digest_to_files,
+                      :empty?
+
+        def initialize
+          @gem_spec_digest_to_files = {}
+        end
+
+        def generate_usage_data activity
+          return unless activity
+
+          @gem_spec_digest_to_files.each_pair do |digest, files|
+            usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
+            activity.library_usages[usage.hash_code] = usage if activity
+          end
+          @gem_spec_digest_to_files.clear
+        end
+
+        def use_cache digest
+          yield get(digest)
+        end
+
+        def get digest
+          @gem_spec_digest_to_files[digest] = Set.new unless @gem_spec_digest_to_files.key?(digest)
+          @gem_spec_digest_to_files[digest]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/inventory_util'
+require 'contrast/components/interface'
+require 'contrast/utils/inventory_util'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/inventory/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/agent/inventory/policy/datastores'
+require 'contrast/agent/inventory/policy/datastores'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/middleware.rb

@@ -1,19 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'ipaddr'
-cs__scoped_require 'json'
-cs__scoped_require 'rack'
+require 'ipaddr'
+require 'json'
+require 'rack'
 
-cs__scoped_require 'contrast/security_exception'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/heap_dump_util'
-cs__scoped_require 'contrast/agent/request_handler'
-cs__scoped_require 'contrast/agent/static_analysis'
+require 'contrast/security_exception'
+require 'contrast/utils/object_share'
+require 'contrast/components/interface'
+require 'contrast/utils/heap_dump_util'
+require 'contrast/agent/request_handler'
+require 'contrast/agent/static_analysis'
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/freeze_util'
+require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -95,8 +94,7 @@ module Contrast
         if CONFIG.invalid?
           AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif CONFIG.disabled?
-          AGENT.disable!
+        elsif AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
           AGENT.enable!
@@ -116,32 +114,33 @@ module Contrast
 
         # make the context available for the lifecycle of this request
         Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
+          logger.request_start
           request_handler = Contrast::Agent::RequestHandler.new(context)
 
-          logger.debug_with_time('HTTP request cycle') do
-            # prefilter sequence
-            with_contrast_scope do
-              context.service_extract_request
-              request_handler.ruleset.prefilter
-            end
+          # prefilter sequence
+          with_contrast_scope do
+            context.service_extract_request
+            request_handler.ruleset.prefilter
+          end
+
+          response = application_code(env) # pass request down the Rack chain with original env
+
+          # postfilter sequence
+          with_contrast_scope do
+            context.extract_after(response) # update context with final response information
 
-            response = application_code(env) # pass request down the Rack chain with original env
-
-            # postfilter sequence
-            with_contrast_scope do
-              context.extract_after(response) # update context with final response information
-
-              if Contrast::Agent.framework_manager.streaming?(env)
-                context.reset_activity
-                request_handler.stream_safe_postfilter
-              else
-                request_handler.ruleset.postfilter
-                # return response stored in the context in case any postfilter rules updated the response data
-                response = context.response&.rack_response || response
-                request_handler.send_activity_messages
-              end
+            if Contrast::Agent.framework_manager.streaming?(env)
+              context.reset_activity
+              request_handler.stream_safe_postfilter
+            else
+              request_handler.ruleset.postfilter
+              # return response stored in the context in case any postfilter rules updated the response data
+              response = context.response&.rack_response || response
+              request_handler.send_activity_messages
             end
           end
+        ensure
+          logger.request_end
         end
 
         response

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extension/module'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/components/interface'
+require 'contrast/extension/module'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Agent
@@ -15,7 +15,7 @@ module Contrast
           access_component :scope
           attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
@@ -59,7 +59,7 @@ module Contrast
           end
 
           def instrument!
-            cs__scoped_require instrumentation_file_path
+            require instrumentation_file_path
             if instrumenting_module
               mod = Module.cs__const_get(instrumenting_module)
               with_contrast_scope { mod.instrument } if mod
@@ -71,10 +71,10 @@ module Contrast
 
           def module_lookup
             @_module_lookup ||= begin
-                                  Module.cs__const_get module_name
-                                rescue StandardError => _e
-                                  nil
-                                end
+              Module.cs__const_get module_name
+            rescue StandardError => _e
+              nil
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
-cs__scoped_require 'contrast/framework/manager'
+require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/components/interface'
+require 'contrast/framework/manager'
 
 module Contrast
   module Agent
@@ -30,19 +30,20 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
+              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+              Contrast::Extension::Assess::StringPropagator.instrument_string
+              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
 
-                                    Contrast::Extension::Protect::Kernel.instrument
-                                    true
-                                  end
+              Contrast::Extension::Protect::Kernel.instrument
+              true
+            end
           end
 
           def apply_load_patches!
@@ -64,13 +65,13 @@ module Contrast
           # handling
           def apply_require_patches!
             @_apply_require_patches ||= begin
-                                          cs__scoped_require 'contrast/extension/thread'
-                                          cs__scoped_require 'contrast/extension/kernel'
-                                          true
-                                        rescue LoadError, StandardError => e
-                                          logger.error('failed instrumenting apply_require_patches!', e)
-                                          false
-                                        end
+              require 'contrast/extension/thread'
+              require 'contrast/extension/kernel'
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
+            end
           end
 
           def after_load_patches

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/method_policy'
 
 module Contrast
   module Agent
@@ -61,16 +61,16 @@ module Contrast
           # @return [Integer] count of methods to be patched
           def num_expected_patches
             @_num_expected_patches ||= begin
-                                         instance_methods = Set.new
-                                         singleton_methods = Set.new
-                                         sort_method_names(source_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(propagator_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(trigger_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(inventory_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(protect_nodes, instance_methods, singleton_methods)
-                                         sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
-                                         instance_methods.length + singleton_methods.length
-                                       end
+              instance_methods = Set.new
+              singleton_methods = Set.new
+              sort_method_names(source_nodes, instance_methods, singleton_methods)
+              sort_method_names(propagator_nodes, instance_methods, singleton_methods)
+              sort_method_names(trigger_nodes, instance_methods, singleton_methods)
+              sort_method_names(inventory_nodes, instance_methods, singleton_methods)
+              sort_method_names(protect_nodes, instance_methods, singleton_methods)
+              sort_method_names(deadzone_nodes, instance_methods, singleton_methods)
+              instance_methods.length + singleton_methods.length
+            end
           end
 
           private

data/lib/contrast/agent/patching/policy/patch.rb

@@ -1,26 +1,26 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-cs__scoped_require 'contrast/components/interface'
+require 'monitor'
+require 'contrast/components/interface'
 
-cs__scoped_require 'contrast/agent'
-cs__scoped_require 'contrast/logger/log'
-cs__scoped_require 'contrast/agent/patching/policy/method_policy'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent'
+require 'contrast/logger/log'
+require 'contrast/agent/patching/policy/method_policy'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/patching/policy/trigger_node'
 
 # assess
-cs__scoped_require 'contrast/agent/assess/policy/policy'
-cs__scoped_require 'contrast/agent/assess/policy/propagation_method'
-cs__scoped_require 'contrast/agent/assess/policy/source_method'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_method'
+require 'contrast/agent/assess/policy/policy'
+require 'contrast/agent/assess/policy/propagation_method'
+require 'contrast/agent/assess/policy/source_method'
+require 'contrast/agent/assess/policy/trigger_method'
 
 # protect
-cs__scoped_require 'contrast/agent/protect/policy/policy'
+require 'contrast/agent/protect/policy/policy'
 
 # inventory
-cs__scoped_require 'contrast/agent/inventory/policy/policy'
+require 'contrast/agent/inventory/policy/policy'
 
 module Contrast
   module Agent
@@ -371,7 +371,7 @@ module Contrast
               when :prepend
                 prepending_module = Module.new
                 prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                prepending_module.send(visibility, :method_name)
+                prepending_module.send(visibility, method_name)
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
               end
@@ -414,4 +414,4 @@ module Contrast
   end
 end
 
-cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'
+require 'cs__contrast_patch/cs__contrast_patch'