contrast-agent 3.14.0 → 4.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +18 -15
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +1 -0
- data/ext/cs__assess_string/cs__assess_string.c +24 -25
- data/ext/cs__assess_string/cs__assess_string.h +3 -1
- data/ext/cs__common/cs__common.c +4 -2
- data/ext/cs__common/cs__common.h +1 -1
- data/lib/contrast.rb +1 -1
- data/lib/contrast/agent.rb +4 -12
- data/lib/contrast/agent/assess.rb +1 -0
- data/lib/contrast/agent/assess/contrast_event.rb +143 -79
- data/lib/contrast/agent/assess/events/source_event.rb +1 -1
- data/lib/contrast/agent/assess/finalizers/freeze.rb +3 -1
- data/lib/contrast/agent/assess/finalizers/hash.rb +45 -1
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +10 -3
- data/lib/contrast/agent/assess/policy/patcher.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy.rb +0 -2
- data/lib/contrast/agent/assess/policy/policy_node.rb +15 -10
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +19 -3
- data/lib/contrast/agent/assess/policy/preshift.rb +7 -11
- data/lib/contrast/agent/assess/policy/propagation_method.rb +50 -33
- data/lib/contrast/agent/assess/policy/propagator/append.rb +8 -5
- data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/center.rb +9 -5
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +5 -3
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +7 -4
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +4 -1
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +4 -7
- data/lib/contrast/agent/assess/policy/propagator/next.rb +7 -5
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +8 -5
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +8 -4
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +5 -2
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +7 -5
- data/lib/contrast/agent/assess/policy/propagator/select.rb +13 -7
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +10 -9
- data/lib/contrast/agent/assess/policy/propagator/split.rb +24 -19
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +47 -31
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +11 -5
- data/lib/contrast/agent/assess/policy/source_method.rb +85 -58
- data/lib/contrast/agent/assess/policy/trigger/reflected_xss.rb +16 -12
- data/lib/contrast/agent/assess/policy/trigger/xpath.rb +1 -1
- data/lib/contrast/agent/assess/policy/trigger_method.rb +76 -28
- data/lib/contrast/agent/assess/policy/trigger_node.rb +38 -43
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +2 -1
- data/lib/contrast/agent/assess/properties.rb +2 -0
- data/lib/contrast/agent/assess/property/evented.rb +5 -18
- data/lib/contrast/agent/assess/property/tagged.rb +9 -3
- data/lib/contrast/agent/assess/property/updated.rb +131 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +58 -5
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +23 -8
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +83 -14
- data/lib/contrast/agent/assess/tag.rb +1 -1
- data/lib/contrast/agent/assess/tracker.rb +66 -0
- data/lib/contrast/agent/at_exit_hook.rb +5 -5
- data/lib/contrast/agent/class_reopener.rb +7 -5
- data/lib/contrast/agent/inventory.rb +15 -0
- data/lib/contrast/agent/inventory/dependencies.rb +50 -0
- data/lib/contrast/agent/inventory/dependency_analysis.rb +37 -0
- data/lib/contrast/agent/inventory/dependency_usage_analysis.rb +104 -0
- data/lib/contrast/agent/inventory/gemfile_digest_cache.rb +38 -0
- data/lib/contrast/agent/middleware.rb +1 -3
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +5 -5
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +20 -20
- data/lib/contrast/agent/patching/policy/module_policy.rb +10 -10
- data/lib/contrast/agent/patching/policy/patch.rb +6 -0
- data/lib/contrast/agent/patching/policy/patcher.rb +13 -22
- data/lib/contrast/agent/patching/policy/policy.rb +17 -6
- data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb +3 -5
- data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb +4 -3
- data/lib/contrast/agent/protect/policy/applies_xxe_rule.rb +1 -1
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +9 -25
- data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +1 -0
- data/lib/contrast/agent/request.rb +34 -34
- data/lib/contrast/agent/request_handler.rb +1 -1
- data/lib/contrast/agent/response.rb +17 -6
- data/lib/contrast/agent/rewriter.rb +1 -3
- data/lib/contrast/agent/scope.rb +59 -53
- data/lib/contrast/agent/static_analysis.rb +7 -7
- data/lib/contrast/agent/tracepoint_hook.rb +1 -1
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/api/communication/messaging_queue.rb +1 -4
- data/lib/contrast/api/communication/socket_client.rb +36 -1
- data/lib/contrast/api/decorators.rb +3 -0
- data/lib/contrast/api/decorators/address.rb +13 -14
- data/lib/contrast/api/decorators/application_update.rb +2 -4
- data/lib/contrast/api/decorators/library.rb +53 -0
- data/lib/contrast/api/decorators/library_usage_update.rb +30 -0
- data/lib/contrast/api/decorators/message.rb +1 -0
- data/lib/contrast/api/decorators/trace_event.rb +25 -23
- data/lib/contrast/common_agent_configuration.rb +2 -1
- data/lib/contrast/components/agent.rb +6 -5
- data/lib/contrast/components/app_context.rb +49 -38
- data/lib/contrast/components/config.rb +30 -48
- data/lib/contrast/components/contrast_service.rb +9 -9
- data/lib/contrast/components/interface.rb +25 -3
- data/lib/contrast/components/inventory.rb +6 -1
- data/lib/contrast/components/scope.rb +49 -6
- data/lib/contrast/components/settings.rb +23 -23
- data/lib/contrast/config/application_configuration.rb +5 -2
- data/lib/contrast/config/inventory_configuration.rb +2 -2
- data/lib/contrast/config/service_configuration.rb +8 -0
- data/lib/contrast/configuration.rb +88 -47
- data/lib/contrast/extension/assess.rb +0 -2
- data/lib/contrast/extension/assess/array.rb +15 -8
- data/lib/contrast/extension/assess/erb.rb +11 -3
- data/lib/contrast/extension/assess/eval_trigger.rb +6 -6
- data/lib/contrast/extension/assess/exec_trigger.rb +1 -4
- data/lib/contrast/extension/assess/fiber.rb +12 -12
- data/lib/contrast/extension/assess/hash.rb +5 -6
- data/lib/contrast/extension/assess/kernel.rb +28 -23
- data/lib/contrast/extension/assess/marshal.rb +11 -6
- data/lib/contrast/extension/assess/regexp.rb +8 -7
- data/lib/contrast/extension/assess/string.rb +21 -21
- data/lib/contrast/extension/protect/kernel.rb +3 -3
- data/lib/contrast/framework/base_support.rb +1 -1
- data/lib/contrast/framework/manager.rb +3 -3
- data/lib/contrast/framework/rack/patch/session_cookie.rb +22 -28
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +13 -13
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +5 -11
- data/lib/contrast/framework/rails/patch/rails_application_configuration.rb +10 -10
- data/lib/contrast/framework/rails/patch/support.rb +1 -1
- data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb +11 -11
- data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb +12 -12
- data/lib/contrast/framework/rails/rewrite/active_record_named.rb +3 -3
- data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb +12 -12
- data/lib/contrast/framework/rails/support.rb +5 -0
- data/lib/contrast/framework/sinatra/patch/base.rb +11 -11
- data/lib/contrast/framework/sinatra/support.rb +4 -4
- data/lib/contrast/logger/application.rb +11 -3
- data/lib/contrast/logger/log.rb +7 -2
- data/lib/contrast/utils/assess/tracking_util.rb +48 -3
- data/lib/contrast/utils/duck_utils.rb +0 -10
- data/lib/contrast/utils/env_configuration_item.rb +2 -1
- data/lib/contrast/utils/invalid_configuration_util.rb +20 -21
- data/lib/contrast/utils/inventory_util.rb +0 -7
- data/lib/contrast/utils/sha256_builder.rb +0 -12
- data/lib/contrast/utils/string_utils.rb +10 -5
- data/resources/assess/policy.json +31 -22
- data/ruby-agent.gemspec +21 -18
- data/service_executables/VERSION +1 -1
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +71 -30
- data/lib/contrast/agent/assess/finalizers/finalize.rb +0 -21
- data/lib/contrast/extension/assess/assess_extension.rb +0 -145
- data/lib/contrast/utils/boolean_util.rb +0 -30
- data/lib/contrast/utils/freeze_util.rb +0 -32
- data/lib/contrast/utils/gemfile_reader.rb +0 -193
@@ -1,9 +1,7 @@
|
|
1
1
|
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
|
-
require 'contrast/utils/boolean_util'
|
5
4
|
require 'contrast/utils/env_configuration_item'
|
6
|
-
require 'contrast/utils/object_share'
|
7
5
|
require 'contrast/configuration'
|
8
6
|
|
9
7
|
module Contrast
|
@@ -34,47 +32,14 @@ module Contrast
|
|
34
32
|
def build log: true
|
35
33
|
@_valid = nil
|
36
34
|
@config = Contrast::Configuration.new
|
37
|
-
|
38
|
-
overrides
|
35
|
+
env_overrides
|
39
36
|
validate(log: log)
|
40
37
|
end
|
41
38
|
alias_method :rebuild, :build
|
42
39
|
|
43
|
-
#
|
44
|
-
# grep 'CONFIG.raw' for opportunities to refactor.
|
45
|
-
def raw
|
46
|
-
@config
|
47
|
-
end
|
48
|
-
|
40
|
+
# @return [Contrast::Config::RootConfiguration]
|
49
41
|
def root
|
50
|
-
|
51
|
-
end
|
52
|
-
|
53
|
-
def enabled?
|
54
|
-
@_enabled = !Contrast::Utils::BooleanUtil.false?(raw.enable) if @_enabled.nil?
|
55
|
-
@_enabled
|
56
|
-
end
|
57
|
-
|
58
|
-
def disabled?
|
59
|
-
!enabled?
|
60
|
-
end
|
61
|
-
|
62
|
-
def protect?
|
63
|
-
@_protect = Contrast::Utils::BooleanUtil.true?(raw.protect.enable) if @_protect.nil?
|
64
|
-
@_protect
|
65
|
-
end
|
66
|
-
|
67
|
-
def assess?
|
68
|
-
@_assess = Contrast::Utils::BooleanUtil.true?(raw.assess.enable) if @_assess.nil?
|
69
|
-
@_assess
|
70
|
-
end
|
71
|
-
|
72
|
-
def session_id
|
73
|
-
@_session_id ||= raw.application.session_id || Contrast::Utils::ObjectShare::EMPTY_STRING
|
74
|
-
end
|
75
|
-
|
76
|
-
def session_metadata
|
77
|
-
@_session_metadata ||= raw.application.session_metadata || Contrast::Utils::ObjectShare::EMPTY_STRING
|
42
|
+
@config.root
|
78
43
|
end
|
79
44
|
|
80
45
|
def valid?
|
@@ -85,6 +50,10 @@ module Contrast
|
|
85
50
|
!valid?
|
86
51
|
end
|
87
52
|
|
53
|
+
def loggable
|
54
|
+
@config.loggable
|
55
|
+
end
|
56
|
+
|
88
57
|
private
|
89
58
|
|
90
59
|
SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
|
@@ -105,15 +74,6 @@ module Contrast
|
|
105
74
|
true
|
106
75
|
end
|
107
76
|
|
108
|
-
def defaults
|
109
|
-
raw.agent.service.host ||= Contrast::Configuration::DEFAULT_HOST
|
110
|
-
raw.agent.service.port ||= Contrast::Configuration::DEFAULT_PORT
|
111
|
-
end
|
112
|
-
|
113
|
-
def overrides
|
114
|
-
env_overrides
|
115
|
-
end
|
116
|
-
|
117
77
|
def env_overrides
|
118
78
|
# For env variables resembling CONTRAST__WHATEVER__NESTED_VALUE
|
119
79
|
# override raw.whatever.nested_value
|
@@ -121,9 +81,31 @@ module Contrast
|
|
121
81
|
next unless env_key.to_s.start_with?(CONTRAST_ENV_MARKER)
|
122
82
|
|
123
83
|
config_item = Contrast::Utils::EnvConfigurationItem.new(env_key, env_value)
|
124
|
-
|
84
|
+
@config.assign_value_to_path_array(config_item.dot_path_array, config_item.value)
|
125
85
|
end
|
126
86
|
end
|
87
|
+
|
88
|
+
# Typically, this would be accessed through
|
89
|
+
# Contrast::Components::AppContext, but we're too early in the
|
90
|
+
# initialization of the Agent to use that mechanism, so we look it up
|
91
|
+
# directly for ourselves
|
92
|
+
#
|
93
|
+
# @return [String,nil] the value of the session id set in the
|
94
|
+
# configuration, or nil if unset
|
95
|
+
def session_id
|
96
|
+
@config.application.session_id
|
97
|
+
end
|
98
|
+
|
99
|
+
# Typically, this would be accessed through
|
100
|
+
# Contrast::Components::AppContext, but we're too early in the
|
101
|
+
# initialization of the Agent to use that mechanism, so we look it up
|
102
|
+
# directly for ourselves
|
103
|
+
#
|
104
|
+
# @return [String,nil] the value of the session metadata set in the
|
105
|
+
# configuration, or nil if unset
|
106
|
+
def session_metadata
|
107
|
+
@config.application.session_metadata
|
108
|
+
end
|
127
109
|
end
|
128
110
|
|
129
111
|
COMPONENT_INTERFACE = Interface.new
|
@@ -26,21 +26,21 @@ module Contrast
|
|
26
26
|
# Validates the config to decide if it's suitable for starting
|
27
27
|
# the bundled service
|
28
28
|
@_use_bundled_service ||= begin
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
29
|
+
# Requirement says "must be true" but that
|
30
|
+
# should be "must not be false" -- oops.
|
31
|
+
!false?(CONFIG.root.agent.start_bundled_service) &&
|
32
|
+
# Either a valid host or a valid socket
|
33
|
+
# Path validity is the service's problem
|
34
|
+
(LOCALHOST.match?(host) || !!socket_path)
|
35
|
+
end
|
36
36
|
end
|
37
37
|
|
38
38
|
def host
|
39
|
-
@_host ||= (CONFIG.root.agent.service.host || Contrast::
|
39
|
+
@_host ||= (CONFIG.root.agent.service.host || Contrast::Config::ServiceConfiguration::DEFAULT_HOST).to_s
|
40
40
|
end
|
41
41
|
|
42
42
|
def port
|
43
|
-
@_port ||= (CONFIG.root.agent.service.port || DEFAULT_PORT).to_i
|
43
|
+
@_port ||= (CONFIG.root.agent.service.port || Contrast::Config::ServiceConfiguration::DEFAULT_PORT).to_i
|
44
44
|
end
|
45
45
|
|
46
46
|
def socket_path
|
@@ -3,7 +3,7 @@
|
|
3
3
|
|
4
4
|
require 'delegate'
|
5
5
|
require 'contrast/extension/module'
|
6
|
-
require 'contrast/utils/
|
6
|
+
require 'contrast/utils/object_share'
|
7
7
|
|
8
8
|
module Contrast
|
9
9
|
# This is the base module for our components classes. It is intended to
|
@@ -49,12 +49,34 @@ module Contrast
|
|
49
49
|
end
|
50
50
|
|
51
51
|
module Methods # :nodoc:
|
52
|
+
# use this to determine if the configuration value is literally boolean
|
53
|
+
# false or some form of the word `false`, regardless of case. It should
|
54
|
+
# be used for those values which default to `true` as they should only
|
55
|
+
# treat a value explicitly set to `false` as such.
|
56
|
+
#
|
57
|
+
# @param config_param [Boolean,String] the value to check
|
58
|
+
# @return [Boolean] should the value be treated as `false`
|
52
59
|
def false? config_param
|
53
|
-
|
60
|
+
return false if config_param == true
|
61
|
+
return true if config_param == false
|
62
|
+
return false unless config_param.cs__is_a?(String)
|
63
|
+
|
64
|
+
Contrast::Utils::ObjectShare::FALSE.casecmp?(config_param)
|
54
65
|
end
|
55
66
|
|
67
|
+
# use this to determine if the configuration value is literally boolean
|
68
|
+
# true or some form of the word `true`, regardless of case. It should
|
69
|
+
# be used for those values which default to `false` as they should only
|
70
|
+
# treat a value explicitly set to `true` as such.
|
71
|
+
#
|
72
|
+
# @param config_param [Boolean,String] the value to check
|
73
|
+
# @return [Boolean] should the value be treated as `true`
|
56
74
|
def true? config_param
|
57
|
-
|
75
|
+
return false if config_param == false
|
76
|
+
return true if config_param == true
|
77
|
+
return false unless config_param.cs__is_a?(String)
|
78
|
+
|
79
|
+
Contrast::Utils::ObjectShare::TRUE.casecmp?(config_param)
|
58
80
|
end
|
59
81
|
end
|
60
82
|
end
|
@@ -13,12 +13,17 @@ module Contrast
|
|
13
13
|
include Contrast::Components::ComponentBase
|
14
14
|
include Contrast::Components::Interface
|
15
15
|
|
16
|
-
access_component :config
|
16
|
+
access_component :config, :settings
|
17
17
|
|
18
18
|
def enabled?
|
19
19
|
@_enabled = !false?(CONFIG.root.inventory.enable) if @_enabled.nil?
|
20
20
|
@_enabled
|
21
21
|
end
|
22
|
+
|
23
|
+
def analyze_libraries?
|
24
|
+
@_analyze_libraries = !false?(CONFIG.root.inventory.analyze_libraries) if @_analyze_libraries.nil?
|
25
|
+
@_analyze_libraries
|
26
|
+
end
|
22
27
|
end
|
23
28
|
|
24
29
|
COMPONENT_INTERFACE = Interface.new
|
@@ -42,18 +42,61 @@ module Contrast
|
|
42
42
|
# For each instance method on a scope, define a forwarder
|
43
43
|
# to the scope on the current execution context's scope.
|
44
44
|
|
45
|
-
Contrast::Agent::Scope.public_instance_methods(false).each do |method_sym|
|
46
|
-
define_method(method_sym) do |*args, &block|
|
47
|
-
scope_for_current_ec.send(method_sym, *args, &block)
|
48
|
-
end
|
49
|
-
end
|
50
|
-
|
51
45
|
def scope_for_current_ec
|
52
46
|
MONITOR.synchronize do
|
53
47
|
return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
|
54
48
|
end
|
55
49
|
end
|
56
50
|
|
51
|
+
def enter_contrast_scope!
|
52
|
+
scope_for_current_ec.enter_contrast_scope!
|
53
|
+
end
|
54
|
+
|
55
|
+
def enter_deserialization_scope!
|
56
|
+
scope_for_current_ec.enter_deserialization_scope!
|
57
|
+
end
|
58
|
+
|
59
|
+
def enter_scope! name
|
60
|
+
scope_for_current_ec.enter_scope! name
|
61
|
+
end
|
62
|
+
|
63
|
+
def exit_contrast_scope!
|
64
|
+
scope_for_current_ec.exit_contrast_scope!
|
65
|
+
end
|
66
|
+
|
67
|
+
def exit_deserialization_scope!
|
68
|
+
scope_for_current_ec.exit_deserialization_scope!
|
69
|
+
end
|
70
|
+
|
71
|
+
def exit_scope! name
|
72
|
+
scope_for_current_ec.exit_scope! name
|
73
|
+
end
|
74
|
+
|
75
|
+
def in_contrast_scope?
|
76
|
+
scope_for_current_ec.in_contrast_scope?
|
77
|
+
end
|
78
|
+
|
79
|
+
def in_deserialization_scope?
|
80
|
+
scope_for_current_ec.in_deserialization_scope?
|
81
|
+
end
|
82
|
+
|
83
|
+
def in_scope? name
|
84
|
+
scope_for_current_ec.in_scope? name
|
85
|
+
end
|
86
|
+
|
87
|
+
def with_contrast_scope
|
88
|
+
scope_for_current_ec.enter_contrast_scope!
|
89
|
+
yield
|
90
|
+
ensure
|
91
|
+
scope_for_current_ec.exit_contrast_scope!
|
92
|
+
end
|
93
|
+
|
94
|
+
def with_deserialization_scope
|
95
|
+
scope_for_current_ec.enter_deserialization_scope!
|
96
|
+
ensure
|
97
|
+
scope_for_current_ec.exit_deserialization_scope!
|
98
|
+
end
|
99
|
+
|
57
100
|
# TODO: RUBY-572
|
58
101
|
#
|
59
102
|
# Current behavior is to no-op if we're not "in a request context".
|
@@ -55,23 +55,25 @@ module Contrast
|
|
55
55
|
APPLICATION_STATE_ATTRS = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
|
56
56
|
|
57
57
|
# Meta-define an accessor for each state attribute.
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
58
|
+
|
59
|
+
PROTECT_STATE_ATTRS.each do |attr|
|
60
|
+
# TODO: RUBY-1052
|
61
|
+
define_method(attr) do # rubocop:disable Kernel/DefineMethod
|
62
|
+
protect_state[attr]
|
63
63
|
end
|
64
|
+
end
|
64
65
|
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
66
|
+
ASSESS_STATE_ATTRS.each do |attr|
|
67
|
+
# TODO: RUBY-1052
|
68
|
+
define_method(attr) do # rubocop:disable Kernel/DefineMethod
|
69
|
+
assess_state[attr]
|
69
70
|
end
|
71
|
+
end
|
70
72
|
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
73
|
+
APPLICATION_STATE_ATTRS.each do |attr|
|
74
|
+
# TODO: RUBY-1052
|
75
|
+
define_method(attr) do # rubocop:disable Kernel/DefineMethod
|
76
|
+
application_state[attr]
|
75
77
|
end
|
76
78
|
end
|
77
79
|
|
@@ -95,18 +97,16 @@ module Contrast
|
|
95
97
|
|
96
98
|
def update_from_server_features server_features
|
97
99
|
# protect
|
98
|
-
|
99
|
-
|
100
|
-
|
101
|
-
end
|
100
|
+
|
101
|
+
@_protect_enabled = nil
|
102
|
+
protect_state[:enabled] = server_features.protect_enabled?
|
102
103
|
|
103
104
|
# assess
|
104
|
-
|
105
|
-
|
106
|
-
|
107
|
-
|
108
|
-
|
109
|
-
end
|
105
|
+
|
106
|
+
@_assess_enabled = nil
|
107
|
+
assess_state[:enabled] = server_features.assess_enabled?
|
108
|
+
assess_state[:sampling_settings] = server_features.assess.sampling
|
109
|
+
Contrast::Utils::Assess::SamplingUtil.instance.update
|
110
110
|
end
|
111
111
|
|
112
112
|
def update_from_application_settings application_settings
|
@@ -1,6 +1,9 @@
|
|
1
1
|
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
|
+
require 'contrast/config/default_value'
|
5
|
+
require 'contrast/utils/object_share'
|
6
|
+
|
4
7
|
module Contrast
|
5
8
|
module Config
|
6
9
|
# Common Configuration settings. Those in this section pertain to the
|
@@ -15,8 +18,8 @@ module Contrast
|
|
15
18
|
tags: EMPTY_VALUE,
|
16
19
|
code: EMPTY_VALUE,
|
17
20
|
metadata: EMPTY_VALUE,
|
18
|
-
session_id:
|
19
|
-
session_metadata:
|
21
|
+
session_id: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::EMPTY_STRING),
|
22
|
+
session_metadata: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::EMPTY_STRING)
|
20
23
|
}.cs__freeze
|
21
24
|
|
22
25
|
def initialize hsh
|
@@ -7,8 +7,8 @@ module Contrast
|
|
7
7
|
# inventory functionality of the Agent.
|
8
8
|
class InventoryConfiguration < BaseConfiguration
|
9
9
|
KEYS = {
|
10
|
-
enable:
|
11
|
-
|
10
|
+
enable: Contrast::Config::DefaultValue.new(true),
|
11
|
+
analyze_libraries: Contrast::Config::DefaultValue.new(true),
|
12
12
|
tags: EMPTY_VALUE
|
13
13
|
}.cs__freeze
|
14
14
|
|
@@ -1,11 +1,19 @@
|
|
1
1
|
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
2
|
# frozen_string_literal: true
|
3
3
|
|
4
|
+
require 'contrast/config/default_value'
|
5
|
+
require 'contrast/config/logger_configuration'
|
6
|
+
|
4
7
|
module Contrast
|
5
8
|
module Config
|
6
9
|
# Common Configuration settings. Those in this section pertain to the
|
7
10
|
# communication between the Agent & the Service.
|
8
11
|
class ServiceConfiguration < BaseConfiguration
|
12
|
+
# We don't set these b/c we've been asked to handle the default values of
|
13
|
+
# these settings differently, logging when we have to use them.
|
14
|
+
DEFAULT_HOST = '127.0.0.1'
|
15
|
+
DEFAULT_PORT = '30555'
|
16
|
+
|
9
17
|
KEYS = {
|
10
18
|
enable: EMPTY_VALUE,
|
11
19
|
host: EMPTY_VALUE,
|
@@ -24,8 +24,6 @@ module Contrast
|
|
24
24
|
attr_reader :default_name, :root
|
25
25
|
|
26
26
|
DEFAULT_YAML_PATH = 'contrast_security.yaml'
|
27
|
-
DEFAULT_HOST = '127.0.0.1'
|
28
|
-
DEFAULT_PORT = '30555'
|
29
27
|
MILLISECOND_MARKER = '_ms'
|
30
28
|
CONVERSION = {
|
31
29
|
'agent.service.enable' => 'agent.start_bundled_service'
|
@@ -37,9 +35,6 @@ module Contrast
|
|
37
35
|
'/etc/contrast/',
|
38
36
|
'/etc/'
|
39
37
|
].cs__freeze
|
40
|
-
REMOVE_FIELDS = [
|
41
|
-
'contrast'
|
42
|
-
].cs__freeze
|
43
38
|
|
44
39
|
def initialize cli_options = nil, default_name = DEFAULT_YAML_PATH
|
45
40
|
@default_name = default_name
|
@@ -53,7 +48,6 @@ module Contrast
|
|
53
48
|
|
54
49
|
# Some in-flight rewrites to maintain backwards compatibility
|
55
50
|
config_kv = update_prop_keys(config_kv)
|
56
|
-
config_kv = deprecate_fields(config_kv)
|
57
51
|
|
58
52
|
@root = Contrast::Config::RootConfiguration.new(config_kv)
|
59
53
|
end
|
@@ -73,6 +67,13 @@ module Contrast
|
|
73
67
|
root&.cs__respond_to?(method_name) || super
|
74
68
|
end
|
75
69
|
|
70
|
+
# Get a loggable YAML format of this configuration
|
71
|
+
# @return [String] the current active configuration of the Agent,
|
72
|
+
# represented as a YAML string
|
73
|
+
def loggable
|
74
|
+
convert_to_hash.to_yaml
|
75
|
+
end
|
76
|
+
|
76
77
|
protected
|
77
78
|
|
78
79
|
# TODO: RUBY-546 move utility methods to auxiliary classes
|
@@ -80,26 +81,16 @@ module Contrast
|
|
80
81
|
def load_config
|
81
82
|
config = {}
|
82
83
|
configuration_paths.find do |path|
|
83
|
-
|
84
|
-
next unless found
|
84
|
+
next unless File.exist?(path)
|
85
85
|
|
86
|
-
|
87
|
-
|
88
|
-
puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
|
86
|
+
unless File.readable?(path)
|
87
|
+
log_file_read_error(path)
|
89
88
|
next
|
90
89
|
end
|
91
90
|
config = yaml_to_hash(path) || {}
|
92
91
|
break
|
93
92
|
end
|
94
93
|
|
95
|
-
if config.empty?
|
96
|
-
puts "!!! Contrast - working directory: #{ Dir.pwd }"
|
97
|
-
puts '!!! Contrast - valid configuration file could not be found at any of the search paths'
|
98
|
-
puts 'Valid configuration paths are: '
|
99
|
-
configuration_paths.each do |path|
|
100
|
-
puts(path)
|
101
|
-
end
|
102
|
-
end
|
103
94
|
config
|
104
95
|
end
|
105
96
|
|
@@ -109,9 +100,10 @@ module Contrast
|
|
109
100
|
yaml = IO.read(path)
|
110
101
|
yaml = ERB.new(yaml).result if defined?(ERB)
|
111
102
|
return YAML.safe_load(yaml)
|
103
|
+
rescue Psych::Exception => e
|
104
|
+
log_yaml_parse_error(path, e)
|
112
105
|
rescue RuntimeError => e
|
113
|
-
puts "
|
114
|
-
puts "ERROR: path=#{ path } pwd=#{ Dir.pwd }"
|
106
|
+
puts "WARN: Unable to load configuration. #{ e }; path: #{ path }, pwd: #{ Dir.pwd }"
|
115
107
|
end
|
116
108
|
end
|
117
109
|
|
@@ -122,29 +114,20 @@ module Contrast
|
|
122
114
|
# files to match the new agreed upon standard configuration
|
123
115
|
# names, so that one file works for all agents
|
124
116
|
def update_prop_keys config
|
125
|
-
converted = false
|
126
117
|
CONVERSION.each_pair do |old_method, new_method|
|
127
118
|
# See if the old value was set and needs to be translated
|
128
119
|
deprecated_keys = old_method.split('.')
|
129
|
-
|
130
120
|
old_value = config
|
131
121
|
deprecated_keys.each do |key|
|
132
122
|
old_value = old_value[key]
|
133
123
|
break if old_value.nil?
|
134
124
|
end
|
125
|
+
next if old_value.nil? # have to account for literal false
|
135
126
|
|
136
|
-
|
137
|
-
|
138
|
-
converted = true
|
139
|
-
|
140
|
-
puts "The deprecated property #{ old_method } is being set."
|
141
|
-
puts "Please update your config to use the property #{ new_method } instead."
|
142
|
-
|
127
|
+
log_deprecated_property(old_method, new_method)
|
143
128
|
new_keys = new_method.split('.')
|
144
|
-
|
145
129
|
# We changed the seconds values into ms values. Multiply them accordingly
|
146
130
|
old_value = old_value.to_i * 1000 if new_method.end_with?(MILLISECOND_MARKER)
|
147
|
-
|
148
131
|
new_value = config
|
149
132
|
end_idx = new_keys.length - 1
|
150
133
|
new_keys.each_with_index do |new_key, index|
|
@@ -161,21 +144,6 @@ module Contrast
|
|
161
144
|
config
|
162
145
|
end
|
163
146
|
|
164
|
-
def deprecate_fields hash
|
165
|
-
REMOVE_FIELDS.each do |field|
|
166
|
-
path = field.split('.')
|
167
|
-
active_path = hash
|
168
|
-
path.each_with_index do |delete_path, index|
|
169
|
-
if index == path.length - 1 && active_path
|
170
|
-
active_path.delete(delete_path)
|
171
|
-
elsif active_path
|
172
|
-
active_path = active_path[delete_path]
|
173
|
-
end
|
174
|
-
end
|
175
|
-
end
|
176
|
-
hash
|
177
|
-
end
|
178
|
-
|
179
147
|
# Base paths to check for the contrast configuration file, sorted by
|
180
148
|
# reverse order of precedence (first is most important).
|
181
149
|
def configuration_paths
|
@@ -208,5 +176,78 @@ module Contrast
|
|
208
176
|
end
|
209
177
|
new_hash
|
210
178
|
end
|
179
|
+
|
180
|
+
private
|
181
|
+
|
182
|
+
# We cannot use all access components at this point, unfortunately, as they
|
183
|
+
# may not have been initialized. Instead, we need to access the logger
|
184
|
+
# directly.
|
185
|
+
def logger
|
186
|
+
@_logger ||= (Contrast::Logger::Log.instance.logger if defined?(Contrast::Logger::Log))
|
187
|
+
end
|
188
|
+
|
189
|
+
# When we fail to parse a configuration because it is misformatted, log an
|
190
|
+
# appropriate message based on the Agent Onboarding specification
|
191
|
+
def log_yaml_parse_error path, exception
|
192
|
+
hash = {
|
193
|
+
path: path,
|
194
|
+
pwd: Dir.pwd
|
195
|
+
}
|
196
|
+
if exception.is_a?(Psych::SyntaxError)
|
197
|
+
hash[:context] = exception.context
|
198
|
+
hash[:column] = exception.column
|
199
|
+
hash[:line] = exception.line
|
200
|
+
hash[:offset] = exception.offset
|
201
|
+
hash[:problem] = exception.problem
|
202
|
+
end
|
203
|
+
|
204
|
+
if logger
|
205
|
+
logger.warn('YAML validator found an error', hash)
|
206
|
+
else
|
207
|
+
puts "CONTRAST - WARN: YAML validator found an error. #{ hash.inspect }"
|
208
|
+
end
|
209
|
+
end
|
210
|
+
|
211
|
+
def log_file_read_error path
|
212
|
+
if logger
|
213
|
+
logger.warn('Configuration file is not readable by current user', path: path)
|
214
|
+
else
|
215
|
+
puts "CONTRAST - WARN: Configuration file is not readable by current user; path: #{ path }"
|
216
|
+
end
|
217
|
+
end
|
218
|
+
|
219
|
+
def log_deprecated_property old_method, new_method
|
220
|
+
if logger
|
221
|
+
logger.warn('Deprecated property in use', old_method: old_method, new_method: new_method)
|
222
|
+
else
|
223
|
+
puts "CONTRAST - WARN: Deprecated property in use; old_method: #{ old_method }, new_method: #{ new_method }"
|
224
|
+
end
|
225
|
+
end
|
226
|
+
|
227
|
+
# Convert this entire configuration into a hash, walking down the entries
|
228
|
+
# in the thing to convert and setting them in the given hash. For now, this
|
229
|
+
# logs every possible key, whether set or not. If we want to change that
|
230
|
+
# behavior, we can skip adding keys to the hash if the value is nil, blank,
|
231
|
+
# or Contrast::Config::DefaultValue depending on desired behavior
|
232
|
+
#
|
233
|
+
# @param hash [Hash] the hash to populate
|
234
|
+
# @param convert [Contrast::Config::BaseConfiguration, Object] the level of
|
235
|
+
# configuration from which to convert. Note that at least one top level
|
236
|
+
# Contrast::Config::BaseConfiguration is required for anything to be set
|
237
|
+
# in the hash
|
238
|
+
# @return [Hash, Object] the leaf of each
|
239
|
+
# Contrast::Config::BaseConfiguration will be returned in the N > 0 steps
|
240
|
+
# the Hash will be returned at the end of the 0 level
|
241
|
+
def convert_to_hash convert = root, hash = {}
|
242
|
+
case convert
|
243
|
+
when Contrast::Config::BaseConfiguration
|
244
|
+
convert.cs__class::KEYS.each_key do |key|
|
245
|
+
hash[key] = convert_to_hash(convert.send(key), {})
|
246
|
+
end
|
247
|
+
hash
|
248
|
+
else
|
249
|
+
convert
|
250
|
+
end
|
251
|
+
end
|
211
252
|
end
|
212
253
|
end
|