contrast-agent 3.14.0 → 4.2.0

data/lib/contrast/api/communication/socket_client.rb

@@ -15,7 +15,7 @@ module Contrast
       # service proxy and tracks the state of that proxy.
       class SocketClient
         include Contrast::Components::Interface
-        access_component :contrast_service, :logging
+        access_component :config, :contrast_service, :logging
 
         def initialize
           @socket = init_connection
@@ -34,6 +34,7 @@ module Contrast
         private
 
         def init_connection
+          log_connection
           if CONTRAST_SERVICE.use_tcp?
             Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
           else
@@ -41,6 +42,40 @@ module Contrast
           end
         end
 
+        def log_connection
+          # The socket is set,
+          if CONFIG.root.agent.service.socket
+            logger.info('Connecting to the Contrast Service using a UnixSocket socket',
+                        socket: CONTRAST_SERVICE.socket_path)
+            return
+          end
+          # The host & port are set,
+          if CONFIG.root.agent.service.host && CONFIG.root.agent.service.port
+            logger.info('Connecting to the Contrast Service using a TCP socket',
+                        host: CONTRAST_SERVICE.host,
+                        port: CONTRAST_SERVICE.port)
+            return
+          end
+
+          # Or something is not set.
+          msg = if CONFIG.root.agent.service.host
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.port` is not set. ' \
+                  'Falling back to default TCP socket port.'
+                elsif CONFIG.root.agent.service.port
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.host` is not set. ' \
+                  'Falling back to default TCP socket host.'
+                else
+                  'Missing a required connection value to the Contrast Service. ' \
+                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+                  'Falling back to default TCP socket.'
+                end
+          logger.warn(msg,
+                      host: CONTRAST_SERVICE.host,
+                      port: CONTRAST_SERVICE.port)
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/decorators.rb

@@ -8,11 +8,14 @@ module Contrast
     end
   end
 end
+
 require 'contrast/api/decorators/message'
 require 'contrast/api/decorators/application_update'
 require 'contrast/api/decorators/input_analysis'
 require 'contrast/api/decorators/application_settings'
 require 'contrast/api/decorators/server_features'
+require 'contrast/api/decorators/library'
+require 'contrast/api/decorators/library_usage_update'
 require 'contrast/api/decorators/route_coverage'
 require 'contrast/api/decorators/trace_event_object'
 require 'contrast/api/decorators/trace_event_signature'

data/lib/contrast/api/decorators/address.rb

@@ -21,26 +21,25 @@ module Contrast
         module ClassMethods
           include Contrast::Components::Interface
           access_component :logging
-
           # receiver is memoized because it is the address/host/port of the server, once we
           # resolve this for the first time, it shouldn't change
           #
           # @return [Contrast::Api::Dtm::Address] the address of this server
           def build_receiver
             @_build_receiver ||= begin
-                             address = new
-                             address.host = 'localhost'
-                             address.ip = '127.0.0.1'
-                             begin
-                               Timeout.timeout(1) do
-                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-                               end
-                             rescue StandardError => e
-                               logger.warn('Unable to resolve host or ip', e, address: address)
-                             end
-                             address
-                           end
+              address = new
+              address.host = 'localhost'
+              address.ip = '127.0.0.1'
+              begin
+                Timeout.timeout(1) do
+                  address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                  address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                end
+              rescue StandardError => e
+                logger.warn('Unable to resolve host or ip', e, address: address)
+              end
+              address
+            end
           end
 
           # Parse out the sender of the Request and return it as an Address

data/lib/contrast/api/decorators/application_update.rb

@@ -18,10 +18,8 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
-        def append_library_update library_dtm_list, library_tags
-          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+        def append_library_update library_dtm_list
           library_dtm_list.each do |library_dtm|
-            library_dtm.tags = lib_tags
             libraries[library_dtm.hash_code] = library_dtm
           end
         end
@@ -46,7 +44,7 @@ module Contrast
             msg = new
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
-            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
             msg
           end
         end

data/lib/contrast/api/decorators/library.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/sha256_builder'
+require 'yaml'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Library protobuf model to handle Gem::Specification translation
+      module Library
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+        # Used to add class methods to the Library class on inclusion of the decorator
+        module ClassMethods
+          def build digest, gem_specification
+            msg = new
+            msg.file_path = Contrast::Utils::StringUtils.force_utf8(gem_specification.name)
+            msg.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
+            msg.version     = Contrast::Utils::StringUtils.force_utf8(gem_specification.version)
+            msg.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(gem_specification))
+            msg.external_ms = date_to_ms(gem_specification.date)
+            msg.internal_ms = msg.external_ms
+            msg.url         = Contrast::Utils::StringUtils.force_utf8(gem_specification.homepage)
+            msg.class_count = file_count(gem_specification.full_gem_path.to_s)
+            msg.used_class_count = 0
+            msg
+          end
+
+          # These are all the code files that are located in the Gem directory loaded
+          # by the current environment; this includes more than Ruby files
+          def file_count path
+            Contrast::Utils::Sha256Builder.instance.files(path).length
+          end
+
+          def build_manifest spec
+            Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s)
+          rescue StandardError
+            nil
+          end
+
+          def date_to_ms date
+            (date.to_f * 1000.0).to_i
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the LibraryUsageUpdate protobuf
+      module LibraryUsageUpdate
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+        # Used to add class methods to the LibraryUsageUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build digest, files
+            msg = new
+            msg.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
+            files.each do |required_file|
+              msg.class_names[required_file] = true
+            end
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::LibraryUsageUpdate.include(Contrast::Api::Decorators::LibraryUsageUpdate)

data/lib/contrast/api/decorators/message.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/utils/object_share'
 require 'contrast/utils/string_utils'
 
 module Contrast

data/lib/contrast/api/decorators/trace_event.rb

@@ -32,25 +32,40 @@ module Contrast
 
           properties = case taint_target
                        when Contrast::Utils::ObjectShare::OBJECT_KEY
-                         contrast_event.object.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.object)
                        when Contrast::Utils::ObjectShare::RETURN_KEY
-                         contrast_event.ret.cs__properties
+                         Contrast::Agent::Assess::Tracker.properties(contrast_event.ret)
                        else
                          target = contrast_event.args[taint_target]
                          if target.is_a?(Hash)
                            if contrast_event.policy_node&.targets&.any?
-                             target[contrast_event.policy_node.targets[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.targets[0]])
                            else
-                             target[contrast_event.policy_node.sources[0]].cs__properties
+                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.sources[0]])
                            end
                          else
-                           target.cs__properties
+                           Contrast::Agent::Assess::Tracker.properties(target)
                          end
                        end
+          return unless properties.tracked?
 
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+          self.taint_ranges += properties.tags_to_dtm
+        end
+
+        def build_parent_ids contrast_event
+          contrast_event&.parent_events&.each do |event|
+            next unless event
+
+            parent = Contrast::Api::Dtm::ParentObjectId.new
+            parent.id = event.event_id.to_i
+            parent_object_ids << parent
+          end
+        end
 
-          properties.tags_to_dtm
+        def build_stack contrast_event
+          # We delayed doing this as long as possible b/c it's expensive
+          stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+          self.stack += stack_dtms
         end
 
         # Class methods for TraceEvent
@@ -71,23 +86,10 @@ module Contrast
             truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
             event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
             event_dtm.build_event_args(contrast_event, taint_target)
-
-            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
-            taint_ranges.each do |range|
-              event_dtm.taint_ranges << range
-            end
-
-            # We delayed doing this as long as possible b/c it's expensive
-            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
-            event_dtm.stack += stack
-
+            event_dtm.build_parent_ids(contrast_event)
+            event_dtm.build_taint_ranges(contrast_event, taint_target)
+            event_dtm.build_stack(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            contrast_event.parent_ids&.each do |id|
-              parent = Contrast::Api::Dtm::ParentObjectId.new
-              parent.id = id.to_i
-              event_dtm.parent_object_ids << parent
-            end
-
             event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
             event_dtm
           end

data/lib/contrast/common_agent_configuration.rb

@@ -65,7 +65,8 @@ module Contrast
       end
 
       %w[name default description required_languages display].each do |field|
-        define_method(field) { hsh[field].dup }
+        # TODO: RUBY-1052
+        define_method(field) { hsh[field].dup } # rubocop:disable Kernel/DefineMethod
       end
     end
 

data/lib/contrast/components/agent.rb

@@ -17,7 +17,8 @@ module Contrast
         access_component :analysis, :config, :settings
 
         def enabled?
-          !!@enabled
+          @_enabled = !false?(CONFIG.root.enable) if @_enabled.nil?
+          @_enabled
         end
 
         def disabled?
@@ -25,11 +26,11 @@ module Contrast
         end
 
         def enable!
-          @enabled = true
+          @_enabled = true
         end
 
         def disable!
-          @enabled = false
+          @_enabled = false
         end
 
         def ruleset
@@ -49,12 +50,12 @@ module Contrast
         end
 
         def patch_yield?
-          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield = !false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
           @_patch_yield
         end
 
         def interpolation_enabled?
-          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled = !false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
           @_interpolation_enabled
         end
 

data/lib/contrast/components/app_context.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'rubygems/version'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Components
@@ -15,7 +16,7 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :agent, :config
+        access_component :agent, :analysis, :config, :logging
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
@@ -28,58 +29,57 @@ module Contrast
 
         def server_type
           @_server_type ||= begin
-                              tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp
-                            end
+            tmp = CONFIG.root.server.type
+            tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp
+          end
         end
 
         def name
           @_name ||= begin
-                       tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
-                     rescue StandardError
-                       DEFAULT_APP_NAME
-                     end
+            tmp = CONFIG.root.application.name
+            tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
+          rescue StandardError
+            DEFAULT_APP_NAME
+          end
         end
 
         def path
           @_path ||= begin
-                       tmp = CONFIG.root.application.path
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
-                     rescue StandardError
-                       DEFAULT_APP_PATH
-                     end
+            tmp = CONFIG.root.application.path
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
+          rescue StandardError
+            DEFAULT_APP_PATH
+          end
         end
 
         def server_name
           @_server_name ||= begin
-                              tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
-                            rescue StandardError
-                              DEFAULT_SERVER_NAME
-                            end
+            tmp = CONFIG.root.server.name
+            tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
+          rescue StandardError
+            DEFAULT_SERVER_NAME
+          end
         end
 
         def server_path
           @_server_path ||= begin
-                              tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
-                            rescue StandardError
-                              DEFAULT_SERVER_PATH
-                            end
+            tmp = CONFIG.root.server.path
+            tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
+          rescue StandardError
+            DEFAULT_SERVER_PATH
+          end
         end
 
         def build_app_startup_message
           msg = Contrast::Api::Dtm::ApplicationCreate.new
 
           msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
-          msg.tags             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
           msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
           msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
           msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
@@ -92,13 +92,24 @@ module Contrast
 
         def build_agent_startup_message
           msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = Contrast::Utils::StringUtils.protobuf_format server_name
-          msg.server_path    = Contrast::Utils::StringUtils.protobuf_format server_path
-          msg.server_type    = Contrast::Utils::StringUtils.protobuf_format server_type
-          msg.server_version = Contrast::Agent::VERSION
-          msg.version        = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
-          msg.environment    = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
-          msg.tags           = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.server_name      = Contrast::Utils::StringUtils.protobuf_format server_name
+          msg.server_path      = Contrast::Utils::StringUtils.protobuf_format server_path
+          msg.server_type      = Contrast::Utils::StringUtils.protobuf_format server_type
+          msg.server_version   = Contrast::Agent::VERSION
+          msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+          msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+          msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+          msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+          msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          logger.info('Application context',
+                      server_name: msg.server_name,
+                      server_path: msg.server_path,
+                      server_type: msg.server_type,
+                      application_name: name,
+                      application_path: path,
+                      application_language: Contrast::Utils::ObjectShare::RUBY)
+
           msg
         end