contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/service_heartbeat.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/worker_thread'
+require 'contrast/components/interface'
+require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent

data/lib/contrast/agent/static_analysis.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/api/decorators/application_update'
+require 'contrast/components/interface'
+require 'contrast/agent/inventory'
+require 'contrast/api/decorators/application_update'
 
 module Contrast
   module Agent
@@ -17,12 +17,12 @@ module Contrast
         # report the already-loaded gems.
         def catchup
           @_catchup ||= begin
-                          with_contrast_scope do
-                            Contrast::Utils::GemfileReader.instance.map_loaded_classes
-                            send_inventory_message
-                            true
-                          end
-                        end
+            with_contrast_scope do
+              Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.catchup
+              send_inventory_message
+              true
+            end
+          end
         rescue StandardError => e
           logger.warn('Unable to run post-initialization static analysis', e)
         end

data/lib/contrast/agent/thread.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/thread_watcher.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/service_heartbeat'
+require 'contrast/components/interface'
+require 'contrast/agent/service_heartbeat'
 
 module Contrast
   module Agent

data/lib/contrast/agent/tracepoint_hook.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -35,7 +35,7 @@ module Contrast
             path = tracepoint_event.path
             return if path&.include?('contrast')
 
-            Contrast::Utils::InventoryUtil.inventory_class(path) if path
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
             Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
             Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module)
             Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.13.2'
+    VERSION = '4.1.0'
   end
 end

data/lib/contrast/api.rb

@@ -10,7 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/api/settings.pb'
-cs__scoped_require 'contrast/api/decorators'
-cs__scoped_require 'contrast/api/communication'
+require 'contrast/api/dtm.pb'
+require 'contrast/api/settings.pb'
+require 'contrast/api/decorators'
+require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -9,12 +9,12 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/communication/service_lifecycle'
-cs__scoped_require 'contrast/api/communication/connection_status'
-cs__scoped_require 'contrast/api/communication/socket'
-cs__scoped_require 'contrast/api/communication/tcp_socket'
-cs__scoped_require 'contrast/api/communication/unix_socket'
-cs__scoped_require 'contrast/api/communication/socket_client'
-cs__scoped_require 'contrast/api/communication/messaging_queue'
-cs__scoped_require 'contrast/api/communication/response_processor'
-cs__scoped_require 'contrast/api/communication/speedracer'
+require 'contrast/api/communication/service_lifecycle'
+require 'contrast/api/communication/connection_status'
+require 'contrast/api/communication/socket'
+require 'contrast/api/communication/tcp_socket'
+require 'contrast/api/communication/unix_socket'
+require 'contrast/api/communication/socket_client'
+require 'contrast/api/communication/messaging_queue'
+require 'contrast/api/communication/response_processor'
+require 'contrast/api/communication/speedracer'

data/lib/contrast/api/communication/messaging_queue.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/worker_thread'
+require 'contrast/components/interface'
+require 'contrast/agent/worker_thread'
 
 module Contrast
   module Api
@@ -67,10 +67,7 @@ module Contrast
         def preprocess_event event
           return unless event.is_a?(Contrast::Api::Dtm::Activity)
 
-          # So set their tags
-          event.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
-
-          # and see if they're even enabled
+          # See if they're even enabled
           event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
         end
       end

data/lib/contrast/api/communication/response_processor.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/reaction_processor'
+require 'contrast/agent/reaction_processor'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/socket_client.rb

@@ -1,12 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'socket'
-cs__scoped_require 'uri'
+require 'socket'
+require 'uri'
 
-cs__scoped_require 'contrast/api/communication/tcp_socket'
-cs__scoped_require 'contrast/api/communication/unix_socket'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/api/communication/tcp_socket'
+require 'contrast/api/communication/unix_socket'
+require 'contrast/components/interface'
 
 module Contrast
   module Api
@@ -15,7 +15,7 @@ module Contrast
       # service proxy and tracks the state of that proxy.
       class SocketClient
         include Contrast::Components::Interface
-        access_component :contrast_service, :logging
+        access_component :config, :contrast_service, :logging
 
         def initialize
           @socket = init_connection
@@ -34,6 +34,7 @@ module Contrast
         private
 
         def init_connection
+          log_connection
           if CONTRAST_SERVICE.use_tcp?
             Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
           else
@@ -41,6 +42,40 @@ module Contrast
           end
         end
 
+        def log_connection
+          # The socket is set,
+          if CONFIG.root.agent.service.socket
+            logger.info('Connecting to the Contrast Service using a UnixSocket socket',
+                        socket: CONTRAST_SERVICE.socket_path)
+            return
+          end
+          # The host & port are set,
+          if CONFIG.root.agent.service.host && CONFIG.root.agent.service.port
+            logger.info('Connecting to the Contrast Service using a TCP socket',
+                        host: CONTRAST_SERVICE.host,
+                        port: CONTRAST_SERVICE.port)
+            return
+          end
+
+          # Or something is not set.
+          msg = if CONFIG.root.agent.service.host
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.port` is not set. ' \
+                  'Falling back to default TCP socket port.'
+                elsif CONFIG.root.agent.service.port
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.host` is not set. ' \
+                  'Falling back to default TCP socket host.'
+                else
+                  'Missing a required connection value to the Contrast Service. ' \
+                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+                  'Falling back to default TCP socket.'
+                end
+          logger.warn(msg,
+                      host: CONTRAST_SERVICE.host,
+                      port: CONTRAST_SERVICE.port)
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/communication/speedracer.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/tcp_socket.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/communication/socket'
+require 'contrast/api/communication/socket'
 
 module Contrast
   module Api

data/lib/contrast/api/communication/unix_socket.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/communication/socket'
+require 'contrast/api/communication/socket'
 
 module Contrast
   module Api

data/lib/contrast/api/decorators.rb

@@ -8,17 +8,20 @@ module Contrast
     end
   end
 end
-cs__scoped_require 'contrast/api/decorators/message'
-cs__scoped_require 'contrast/api/decorators/application_update'
-cs__scoped_require 'contrast/api/decorators/input_analysis'
-cs__scoped_require 'contrast/api/decorators/application_settings'
-cs__scoped_require 'contrast/api/decorators/server_features'
-cs__scoped_require 'contrast/api/decorators/route_coverage'
-cs__scoped_require 'contrast/api/decorators/trace_event_object'
-cs__scoped_require 'contrast/api/decorators/trace_event_signature'
-cs__scoped_require 'contrast/api/decorators/trace_taint_range'
-cs__scoped_require 'contrast/api/decorators/trace_event'
-cs__scoped_require 'contrast/api/decorators/rasp_rule_sample'
-cs__scoped_require 'contrast/api/decorators/user_input'
-cs__scoped_require 'contrast/api/decorators/address'
-cs__scoped_require 'contrast/api/decorators/http_request'
+
+require 'contrast/api/decorators/message'
+require 'contrast/api/decorators/application_update'
+require 'contrast/api/decorators/input_analysis'
+require 'contrast/api/decorators/application_settings'
+require 'contrast/api/decorators/server_features'
+require 'contrast/api/decorators/library'
+require 'contrast/api/decorators/library_usage_update'
+require 'contrast/api/decorators/route_coverage'
+require 'contrast/api/decorators/trace_event_object'
+require 'contrast/api/decorators/trace_event_signature'
+require 'contrast/api/decorators/trace_taint_range'
+require 'contrast/api/decorators/trace_event'
+require 'contrast/api/decorators/rasp_rule_sample'
+require 'contrast/api/decorators/user_input'
+require 'contrast/api/decorators/address'
+require 'contrast/api/decorators/http_request'

data/lib/contrast/api/decorators/address.rb

@@ -1,16 +1,17 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the Address protobuf model so it can own some of the
-      # data massaging required for Request dtm
+      # Used to decorate the {Contrast::Api::Dtm::Address} protobuf model so it
+      # can own some of the data massaging required for Request dtm. Only works
+      # as an extension of that class.
       module Address
         def self.included klass
           klass.extend(ClassMethods)
@@ -20,26 +21,25 @@ module Contrast
         module ClassMethods
           include Contrast::Components::Interface
           access_component :logging
-
           # receiver is memoized because it is the address/host/port of the server, once we
           # resolve this for the first time, it shouldn't change
           #
           # @return [Contrast::Api::Dtm::Address] the address of this server
           def build_receiver
             @_build_receiver ||= begin
-                             address = new
-                             address.host = 'localhost'
-                             address.ip = '127.0.0.1'
-                             begin
-                               Timeout.timeout(1) do
-                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-                               end
-                             rescue StandardError => e
-                               logger.warn('Unable to resolve host or ip', e, address: address)
-                             end
-                             address
-                           end
+              address = new
+              address.host = 'localhost'
+              address.ip = '127.0.0.1'
+              begin
+                Timeout.timeout(1) do
+                  address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                  address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                end
+              rescue StandardError => e
+                logger.warn('Unable to resolve host or ip', e, address: address)
+              end
+              address
+            end
           end
 
           # Parse out the sender of the Request and return it as an Address

data/lib/contrast/api/decorators/application_settings.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationSettings protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ApplicationSettings}
+      # protobuf model to handle setting translation.
       module ApplicationSettings
         MODE_ALLOWLIST = [
           Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,

data/lib/contrast/api/decorators/application_update.rb

@@ -1,14 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
-      # AppUpdate dtm
+      # Used to decorate the {Contrast::Api::Dtm::ApplicationUpdate} protobuf
+      # model so it can own some of the data massaging required for AppUpdate
+      # dtm.
       module ApplicationUpdate
         include Contrast::Components::Interface
         access_component :config
@@ -17,10 +18,8 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
-        def append_library_update library_dtm_list, library_tags
-          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+        def append_library_update library_dtm_list
           library_dtm_list.each do |library_dtm|
-            library_dtm.tags = lib_tags
             libraries[library_dtm.hash_code] = library_dtm
           end
         end
@@ -45,7 +44,7 @@ module Contrast
             msg = new
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
-            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
             msg
           end
         end

data/lib/contrast/api/decorators/http_request.rb

@@ -1,17 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/api/dtm.pb'
-cs__scoped_require 'contrast/api/decorators/address'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/api/dtm.pb'
+require 'contrast/api/decorators/address'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/timer'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the HttpRequest protobuf model so it can own some of
-      # the data massaging required for Request dtm
+      # Used to decorate the {Contrast::Api::Dtm::HttpRequest} protobuf model
+      # so it can own some of the data massaging required for Request dtm. Only
+      # works as an extension of that class.
       module HttpRequest
         include Contrast::Components::Interface
         access_component :agent
@@ -24,7 +25,7 @@ module Contrast
 
         # Append the sender and receiver to self.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_addresses request
           self.sender = Contrast::Api::Dtm::Address.build_sender(request)
           self.receiver = Contrast::Api::Dtm::Address.build_receiver
@@ -32,7 +33,7 @@ module Contrast
 
         # Append the connection to self.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_connection request
           self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
           self.version = '1.1' # currently not in rack request; hard-coding
@@ -43,7 +44,7 @@ module Contrast
         # Append the parameters to self, using the preferred
         # normalized_request_params field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_params request
           request.parameters.each do |k, v|
             append_pair(normalized_request_params, k, v)
@@ -53,7 +54,7 @@ module Contrast
         # Append the normalized headers to self, using the preferred
         # request_headers field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_headers request
           request.headers.each do |k, v|
             next unless k && v
@@ -72,7 +73,7 @@ module Contrast
         # Append the body to self, using the preferred
         # request_body_binary field.
         #
-        # @param request [Contrast::Api::Dtm::HttpRequest]
+        # @param request [Contrast::Agent::Request]
         def append_body request
           self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)