contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/api/decorators/input_analysis.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      # Used to decorate the {Contrast::Api::Settings::InputAnalysis} protobuf
+      # model so it can own the request which its data is for.
       module InputAnalysis
         attr_accessor :request
       end

data/lib/contrast/api/decorators/library.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/sha256_builder'
+require 'yaml'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Library protobuf model to handle Gem::Specification translation
+      module Library
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+        # Used to add class methods to the Library class on inclusion of the decorator
+        module ClassMethods
+          def build digest, gem_specification
+            msg = new
+            msg.file_path = Contrast::Utils::StringUtils.force_utf8(gem_specification.name)
+            msg.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
+            msg.version     = Contrast::Utils::StringUtils.force_utf8(gem_specification.version)
+            msg.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(gem_specification))
+            msg.external_ms = date_to_ms(gem_specification.date)
+            msg.internal_ms = msg.external_ms
+            msg.url         = Contrast::Utils::StringUtils.force_utf8(gem_specification.homepage)
+            msg.class_count = file_count(gem_specification.full_gem_path.to_s)
+            msg.used_class_count = 0
+            msg
+          end
+
+          # These are all the code files that are located in the Gem directory loaded
+          # by the current environment; this includes more than Ruby files
+          def file_count path
+            Contrast::Utils::Sha256Builder.instance.files(path).length
+          end
+
+          def build_manifest spec
+            Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s)
+          rescue StandardError
+            nil
+          end
+
+          def date_to_ms date
+            (date.to_f * 1000.0).to_i
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the LibraryUsageUpdate protobuf
+      module LibraryUsageUpdate
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+        # Used to add class methods to the LibraryUsageUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build digest, files
+            msg = new
+            msg.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
+            files.each do |required_file|
+              msg.class_names[required_file] = true
+            end
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::LibraryUsageUpdate.include(Contrast::Api::Decorators::LibraryUsageUpdate)

data/lib/contrast/api/decorators/message.rb

@@ -1,12 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the Message protobuf model so it can handle instance data massaging
+      # Used to decorate the {Contrast::Api::Dtm::Message} protobuf model so it
+      # can handle instance data massaging.
       module Message
         include Contrast::Components::Interface
         access_component :app_context, :logging

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -4,7 +4,8 @@
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the RaspRuleSample protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::RaspRuleSample} protobuf
+      # model.
       module RaspRuleSample
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/route_coverage.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the RouteCoverage protobuf model to handle conversion between framework route classes
+      # Used to decorate the {Contrast::Api::Dtm::RouteCoverage} protobuf model
+      # to handle conversion between framework route classes and the dtm.
       module RouteCoverage
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/server_features.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ServerFeatures} protobuf
+      # model to handle setting translation to boolean values.
       module ServerFeatures
         # 'defend' is legacy for 'protect' in the dtm.
         def protect_enabled?

data/lib/contrast/api/decorators/trace_event.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEvent protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEvent} protobuf model to
+      # convert our {Contrast::Agent::AssessContrastEvent} to the dtm.
       module TraceEvent
         def self.included klass
           klass.extend(ClassMethods)
@@ -31,25 +32,40 @@ module Contrast
 
           properties = case taint_target
                        when Contrast::Utils::ObjectShare::OBJECT_KEY
-                         contrast_event.object.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.object)
                        when Contrast::Utils::ObjectShare::RETURN_KEY
-                         contrast_event.ret.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.ret)
                        else
                          target = contrast_event.args[taint_target]
                          if target.is_a?(Hash)
                            if contrast_event.policy_node&.targets&.any?
-                             target[contrast_event.policy_node.targets[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.targets[0]])
                            else
-                             target[contrast_event.policy_node.sources[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.sources[0]])
                            end
                          else
-                           target.cs__properties
+                           Contrast::Agent::Assess::Tracker.properties(target)
                          end
                        end
+          return unless properties.tracked?
 
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+          self.taint_ranges += properties.tags_to_dtm
+        end
+
+        def build_parent_ids contrast_event
+          contrast_event&.parent_events&.each do |event|
+            next unless event
+
+            parent = Contrast::Api::Dtm::ParentObjectId.new
+            parent.id = event.event_id.to_i
+            parent_object_ids << parent
+          end
+        end
 
-          properties.tags_to_dtm
+        def build_stack contrast_event
+          # We delayed doing this as long as possible b/c it's expensive
+          stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+          self.stack += stack_dtms
         end
 
         # Class methods for TraceEvent
@@ -70,23 +86,10 @@ module Contrast
             truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
             event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
             event_dtm.build_event_args(contrast_event, taint_target)
-
-            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
-            taint_ranges.each do |range|
-              event_dtm.taint_ranges << range
-            end
-
-            # We delayed doing this as long as possible b/c it's expensive
-            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
-            event_dtm.stack += stack
-
+            event_dtm.build_parent_ids(contrast_event)
+            event_dtm.build_taint_ranges(contrast_event, taint_target)
+            event_dtm.build_stack(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            contrast_event.parent_ids&.each do |id|
-              parent = Contrast::Api::Dtm::ParentObjectId.new
-              parent.id = id.to_i
-              event_dtm.parent_object_ids << parent
-            end
-
             event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
             event_dtm
           end

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -1,15 +1,16 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
+require 'contrast/components/interface'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventObject protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventObject} protobuf
+      # model.
       module TraceEventObject
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -1,14 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventSignature protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventSignature} protobuf
+      # model.
       module TraceEventSignature
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -1,13 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceTaintRange protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::TraceTaintRange} protobuf
+      # model.
       module TraceTaintRange
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/api/decorators/user_input.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'base64'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the TraceEventObject protobuf model
+      # Used to decorate the {Contrast::Api::Dtm::UserInput} protobuf model.
       module UserInput
         UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
           user_input.input_type = :UNKNOWN

data/lib/contrast/common_agent_configuration.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# rubocop:disable Style/MethodMissingSuper, Style/MissingRespondToMissing
+# rubocop:disable Style/MissingRespondToMissing
 module Contrast
   # A wrapper build around the Common Agent Configuration project to allow for
   # access of the values contained in its parent_configuration_spec.yaml
@@ -83,4 +83,4 @@ module Contrast
     end
   end
 end
-# rubocop:enable Style/MethodMissingSuper, Style/MissingRespondToMissing
+# rubocop:enable Style/MissingRespondToMissing

data/lib/contrast/components/agent.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'rubygems/version'
-cs__scoped_require 'contrast/agent/rule_set'
+require 'rubygems/version'
+require 'contrast/agent/rule_set'
 
 module Contrast
   module Components
@@ -17,7 +17,8 @@ module Contrast
         access_component :analysis, :config, :settings
 
         def enabled?
-          !!@enabled
+          @_enabled = !false?(CONFIG.root.enable) if @_enabled.nil?
+          @_enabled
         end
 
         def disabled?
@@ -25,11 +26,11 @@ module Contrast
         end
 
         def enable!
-          @enabled = true
+          @_enabled = true
         end
 
         def disable!
-          @enabled = false
+          @_enabled = false
         end
 
         def ruleset
@@ -49,12 +50,12 @@ module Contrast
         end
 
         def patch_yield?
-          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield = !false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
           @_patch_yield
         end
 
         def interpolation_enabled?
-          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled = !false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
           @_interpolation_enabled
         end
 

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'rubygems/version'
+require 'rubygems/version'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Components
@@ -15,7 +16,7 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :agent, :config
+        access_component :agent, :analysis, :config, :logging
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
@@ -28,58 +29,57 @@ module Contrast
 
         def server_type
           @_server_type ||= begin
-                              tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp
-                            end
+            tmp = CONFIG.root.server.type
+            tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp
+          end
         end
 
         def name
           @_name ||= begin
-                       tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
-                     rescue StandardError
-                       DEFAULT_APP_NAME
-                     end
+            tmp = CONFIG.root.application.name
+            tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
+          rescue StandardError
+            DEFAULT_APP_NAME
+          end
         end
 
         def path
           @_path ||= begin
-                       tmp = CONFIG.root.application.path
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
-                     rescue StandardError
-                       DEFAULT_APP_PATH
-                     end
+            tmp = CONFIG.root.application.path
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
+          rescue StandardError
+            DEFAULT_APP_PATH
+          end
         end
 
         def server_name
           @_server_name ||= begin
-                              tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
-                            rescue StandardError
-                              DEFAULT_SERVER_NAME
-                            end
+            tmp = CONFIG.root.server.name
+            tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
+          rescue StandardError
+            DEFAULT_SERVER_NAME
+          end
         end
 
         def server_path
           @_server_path ||= begin
-                              tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
-                            rescue StandardError
-                              DEFAULT_SERVER_PATH
-                            end
+            tmp = CONFIG.root.server.path
+            tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
+          rescue StandardError
+            DEFAULT_SERVER_PATH
+          end
         end
 
         def build_app_startup_message
           msg = Contrast::Api::Dtm::ApplicationCreate.new
 
           msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
-          msg.tags             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
           msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
           msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
           msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
@@ -92,13 +92,24 @@ module Contrast
 
         def build_agent_startup_message
           msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = Contrast::Utils::StringUtils.protobuf_format server_name
-          msg.server_path    = Contrast::Utils::StringUtils.protobuf_format server_path
-          msg.server_type    = Contrast::Utils::StringUtils.protobuf_format server_type
-          msg.server_version = Contrast::Agent::VERSION
-          msg.version        = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
-          msg.environment    = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
-          msg.tags           = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.server_name      = Contrast::Utils::StringUtils.protobuf_format server_name
+          msg.server_path      = Contrast::Utils::StringUtils.protobuf_format server_path
+          msg.server_type      = Contrast::Utils::StringUtils.protobuf_format server_type
+          msg.server_version   = Contrast::Agent::VERSION
+          msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+          msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+          msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+          msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          logger.info('Application context',
+                      server_name: msg.server_name,
+                      server_path: msg.server_path,
+                      server_type: msg.server_type,
+                      application_name: name,
+                      application_path: path,
+                      application_language: Contrast::Utils::ObjectShare::RUBY)
+
           msg
         end