contrast-agent 3.15.0 → 4.3.0

data/lib/contrast/api/decorators/user_input.rb

@@ -12,7 +12,8 @@ module Contrast
       module UserInput
         UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
           user_input.input_type = :UNKNOWN
-        end.cs__freeze
+        end
+        UNKNOWN_USER_INPUT.cs__freeze
 
         def self.included klass
           klass.extend(ClassMethods)

data/lib/contrast/common_agent_configuration.rb

@@ -65,7 +65,8 @@ module Contrast
       end
 
       %w[name default description required_languages display].each do |field|
-        define_method(field) { hsh[field].dup }
+        # TODO: RUBY-1052
+        define_method(field) { hsh[field].dup } # rubocop:disable Performance/Kernel/DefineMethod
       end
     end
 

data/lib/contrast/components/agent.rb

@@ -17,7 +17,8 @@ module Contrast
         access_component :analysis, :config, :settings
 
         def enabled?
-          !!@enabled
+          @_enabled = !false?(CONFIG.root.enable) if @_enabled.nil?
+          @_enabled
         end
 
         def disabled?
@@ -25,11 +26,11 @@ module Contrast
         end
 
         def enable!
-          @enabled = true
+          @_enabled = true
         end
 
         def disable!
-          @enabled = false
+          @_enabled = false
         end
 
         def ruleset
@@ -49,12 +50,12 @@ module Contrast
         end
 
         def patch_yield?
-          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield = !false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
           @_patch_yield
         end
 
         def interpolation_enabled?
-          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled = !false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
           @_interpolation_enabled
         end
 

data/lib/contrast/components/app_context.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require 'rubygems/version'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Components
@@ -15,7 +16,7 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :agent, :analysis, :config
+        access_component :agent, :analysis, :config, :logging
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
@@ -28,51 +29,51 @@ module Contrast
 
         def server_type
           @_server_type ||= begin
-                              tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp
-                            end
+            tmp = CONFIG.root.server.type
+            tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp
+          end
         end
 
         def name
           @_name ||= begin
-                       tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
-                     rescue StandardError
-                       DEFAULT_APP_NAME
-                     end
+            tmp = CONFIG.root.application.name
+            tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
+          rescue StandardError
+            DEFAULT_APP_NAME
+          end
         end
 
         def path
           @_path ||= begin
-                       tmp = CONFIG.root.application.path
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
-                     rescue StandardError
-                       DEFAULT_APP_PATH
-                     end
+            tmp = CONFIG.root.application.path
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
+          rescue StandardError
+            DEFAULT_APP_PATH
+          end
         end
 
         def server_name
           @_server_name ||= begin
-                              tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
-                              tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
-                            rescue StandardError
-                              DEFAULT_SERVER_NAME
-                            end
+            tmp = CONFIG.root.server.name
+            tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
+          rescue StandardError
+            DEFAULT_SERVER_NAME
+          end
         end
 
         def server_path
           @_server_path ||= begin
-                              tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
-                            rescue StandardError
-                              DEFAULT_SERVER_PATH
-                            end
+            tmp = CONFIG.root.server.path
+            tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
+          rescue StandardError
+            DEFAULT_SERVER_PATH
+          end
         end
 
         def build_app_startup_message
@@ -101,6 +102,14 @@ module Contrast
           msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
           msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
           msg.finding_tags     = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+          logger.info('Application context',
+                      server_name: msg.server_name,
+                      server_path: msg.server_path,
+                      server_type: msg.server_type,
+                      application_name: name,
+                      application_path: path,
+                      application_language: Contrast::Utils::ObjectShare::RUBY)
+
           msg
         end
 

data/lib/contrast/components/assess.rb

@@ -35,6 +35,42 @@ module Contrast
           disabled_rules.include?(name)
         end
 
+        # The value of the stacktrace should be treated as an ENUM. We upcase it for
+        # faster comparisons when we use it. Anything not one of the known values of
+        # 'NONE',  'SOME', or 'ALL' is treated as 'ALL'
+        #
+        # @return [Symbol] the normalized value of CONFIG.root.assess.stacktraces
+        def capture_stacktrace_value
+          @_capture_stacktrace_value ||= case CONFIG.root.assess.stacktraces.upcase
+                                         when 'NONE'
+                                           :NONE
+                                         when 'SOME'
+                                           :SOME
+                                         else
+                                           :ALL
+                                         end
+        end
+
+        # Consider capture_stacktrace_value along with the node type
+        # to dertmine whether stacktraces should be captured.
+        #
+        # capture_stacktrace_value -> (:ALL, :NONE, :SOME)
+        # node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
+        #
+        # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
+        # @param return [Boolean] to capture or not to capture, that is the question.
+        def capture_stacktrace? policy_node
+          return true if capture_stacktrace_value == :ALL
+
+          return false if capture_stacktrace_value == :NONE
+
+          # Below here capture_stacktrace_value must be :SOME.
+          return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::SourceNode)
+          return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::TriggerNode)
+
+          false
+        end
+
         def scan_response?
           @_scan_response = !false?(CONFIG.root.assess.enable_scan_response) if @_scan_response.nil?
           @_scan_response

data/lib/contrast/components/config.rb

@@ -1,9 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-require 'contrast/utils/boolean_util'
 require 'contrast/utils/env_configuration_item'
-require 'contrast/utils/object_share'
 require 'contrast/configuration'
 
 module Contrast
@@ -39,41 +37,9 @@ module Contrast
         end
         alias_method :rebuild, :build
 
-        # Prefer abstraction, but use #raw if you need.
-        # grep 'CONFIG.raw' for opportunities to refactor.
-        def raw
-          @config
-        end
-
+        # @return [Contrast::Config::RootConfiguration]
         def root
-          raw.root
-        end
-
-        def enabled?
-          @_enabled = !Contrast::Utils::BooleanUtil.false?(raw.enable) if @_enabled.nil?
-          @_enabled
-        end
-
-        def disabled?
-          !enabled?
-        end
-
-        def protect?
-          @_protect = Contrast::Utils::BooleanUtil.true?(raw.protect.enable) if @_protect.nil?
-          @_protect
-        end
-
-        def assess?
-          @_assess = Contrast::Utils::BooleanUtil.true?(raw.assess.enable) if @_assess.nil?
-          @_assess
-        end
-
-        def session_id
-          @_session_id ||= raw.application.session_id
-        end
-
-        def session_metadata
-          @_session_metadata ||= raw.application.session_metadata
+          @config.root
         end
 
         def valid?
@@ -84,6 +50,10 @@ module Contrast
           !valid?
         end
 
+        def loggable
+          @config.loggable
+        end
+
         private
 
         SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
@@ -111,9 +81,31 @@ module Contrast
             next unless env_key.to_s.start_with?(CONTRAST_ENV_MARKER)
 
             config_item = Contrast::Utils::EnvConfigurationItem.new(env_key, env_value)
-            raw.assign_value_to_path_array(config_item.dot_path_array, config_item.value)
+            @config.assign_value_to_path_array(config_item.dot_path_array, config_item.value)
           end
         end
+
+        # Typically, this would be accessed through
+        # Contrast::Components::AppContext, but we're too early in the
+        # initialization of the Agent to use that mechanism, so we look it up
+        # directly for ourselves
+        #
+        # @return [String,nil] the value of the session id set in the
+        #   configuration, or nil if unset
+        def session_id
+          @config.application.session_id
+        end
+
+        # Typically, this would be accessed through
+        # Contrast::Components::AppContext, but we're too early in the
+        # initialization of the Agent to use that mechanism, so we look it up
+        # directly for ourselves
+        #
+        # @return [String,nil] the value of the session metadata set in the
+        #   configuration, or nil if unset
+        def session_metadata
+          @config.application.session_metadata
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/contrast_service.rb

@@ -26,21 +26,21 @@ module Contrast
           # Validates the config to decide if it's suitable for starting
           # the bundled service
           @_use_bundled_service ||= begin
-                                      # Requirement says "must be true" but that
-                                      # should be "must not be false" -- oops.
-                                      !false?(CONFIG.root.agent.start_bundled_service) &&
-                                          # Either a valid host or a valid socket
-                                          # Path validity is the service's problem
-                                          (LOCALHOST.match?(host) || !!socket_path)
-                                    end
+            # Requirement says "must be true" but that
+            # should be "must not be false" -- oops.
+            !false?(CONFIG.root.agent.start_bundled_service) &&
+                # Either a valid host or a valid socket
+                # Path validity is the service's problem
+                (LOCALHOST.match?(host) || !!socket_path)
+          end
         end
 
         def host
-          @_host ||= CONFIG.root.agent.service.host.to_s
+          @_host ||= (CONFIG.root.agent.service.host || Contrast::Config::ServiceConfiguration::DEFAULT_HOST).to_s
         end
 
         def port
-          @_port ||= CONFIG.root.agent.service.port.to_i
+          @_port ||= (CONFIG.root.agent.service.port || Contrast::Config::ServiceConfiguration::DEFAULT_PORT).to_i
         end
 
         def socket_path

data/lib/contrast/components/interface.rb

@@ -3,7 +3,7 @@
 
 require 'delegate'
 require 'contrast/extension/module'
-require 'contrast/utils/boolean_util'
+require 'contrast/utils/object_share'
 
 module Contrast
   # This is the base module for our components classes. It is intended to
@@ -49,12 +49,34 @@ module Contrast
       end
 
       module Methods # :nodoc:
+        # use this to determine if the configuration value is literally boolean
+        # false or some form of the word `false`, regardless of case. It should
+        # be used for those values which default to `true` as they should only
+        # treat a value explicitly set to `false` as such.
+        #
+        # @param config_param [Boolean,String] the value to check
+        # @return [Boolean] should the value be treated as `false`
         def false? config_param
-          Contrast::Utils::BooleanUtil.false?(config_param)
+          return false if config_param == true
+          return true if config_param == false
+          return false unless config_param.cs__is_a?(String)
+
+          Contrast::Utils::ObjectShare::FALSE.casecmp?(config_param)
         end
 
+        # use this to determine if the configuration value is literally boolean
+        # true or some form of the word `true`, regardless of case. It should
+        # be used for those values which default to `false` as they should only
+        # treat a value explicitly set to `true` as such.
+        #
+        # @param config_param [Boolean,String] the value to check
+        # @return [Boolean] should the value be treated as `true`
         def true? config_param
-          Contrast::Utils::BooleanUtil.true?(config_param)
+          return false if config_param == false
+          return true if config_param == true
+          return false unless config_param.cs__is_a?(String)
+
+          Contrast::Utils::ObjectShare::TRUE.casecmp?(config_param)
         end
       end
     end
@@ -146,9 +168,11 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:settings]
 require 'contrast/components/assess'
 require 'contrast/components/protect'
 require 'contrast/components/inventory'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [Contrast::Components::Protect,
-                                                                                   Contrast::Components::Assess,
-                                                                                   Contrast::Components::Inventory]
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [
+  Contrast::Components::Protect,
+  Contrast::Components::Assess,
+  Contrast::Components::Inventory
+]
 
 require 'contrast/components/logger'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] = [Contrast::Components::Logger]

data/lib/contrast/components/inventory.rb

@@ -13,12 +13,17 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :config, :settings
 
         def enabled?
           @_enabled = !false?(CONFIG.root.inventory.enable) if @_enabled.nil?
           @_enabled
         end
+
+        def analyze_libraries?
+          @_analyze_libraries = !false?(CONFIG.root.inventory.analyze_libraries) if @_analyze_libraries.nil?
+          @_analyze_libraries
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/scope.rb

@@ -42,18 +42,84 @@ module Contrast
         # For each instance method on a scope, define a forwarder
         # to the scope on the current execution context's scope.
 
-        Contrast::Agent::Scope.public_instance_methods(false).each do |method_sym|
-          define_method(method_sym) do |*args, &block|
-            scope_for_current_ec.send(method_sym, *args, &block)
-          end
-        end
-
         def scope_for_current_ec
           MONITOR.synchronize do
             return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
           end
         end
 
+        def enter_contrast_scope!
+          scope_for_current_ec.enter_contrast_scope!
+        end
+
+        def enter_deserialization_scope!
+          scope_for_current_ec.enter_deserialization_scope!
+        end
+
+        def enter_split_scope!
+          scope_for_current_ec.enter_split_scope!
+        end
+
+        def enter_scope! name
+          scope_for_current_ec.enter_scope! name
+        end
+
+        def exit_contrast_scope!
+          scope_for_current_ec.exit_contrast_scope!
+        end
+
+        def exit_deserialization_scope!
+          scope_for_current_ec.exit_deserialization_scope!
+        end
+
+        def exit_split_scope!
+          scope_for_current_ec.exit_split_scope!
+        end
+
+        def exit_scope! name
+          scope_for_current_ec.exit_scope! name
+        end
+
+        def in_contrast_scope?
+          scope_for_current_ec.in_contrast_scope?
+        end
+
+        def in_deserialization_scope?
+          scope_for_current_ec.in_deserialization_scope?
+        end
+
+        def in_split_scope?
+          scope_for_current_ec.in_split_scope?
+        end
+
+        def split_scope_depth
+          scope_for_current_ec.split_scope_depth
+        end
+
+        def in_scope? name
+          scope_for_current_ec.in_scope? name
+        end
+
+        def with_contrast_scope
+          scope_for_current_ec.enter_contrast_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_contrast_scope!
+        end
+
+        def with_deserialization_scope
+          scope_for_current_ec.enter_deserialization_scope!
+        ensure
+          scope_for_current_ec.exit_deserialization_scope!
+        end
+
+        def with_split_scope
+          scope_for_current_ec.enter_split_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_split_scope!
+        end
+
         # TODO: RUBY-572
         #
         # Current behavior is to no-op if we're not "in a request context".