contrast-agent 3.15.0 → 4.3.0

data/lib/contrast/agent/at_exit_hook.rb

@@ -11,11 +11,11 @@ module Contrast
       access_component :logging
       def self.exit_hook
         @_exit_hook ||= begin
-                          at_exit do
-                            on_exit
-                          end
-                          true
-                        end
+          at_exit do
+            on_exit
+          end
+          true
+        end
       end
 
       # Actions to take when a process exits. Typically called from our

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -19,6 +19,13 @@ module Contrast
           def feature
             'Deadzone'
           end
+
+          # Deadzone means place the code inside of the contrast scope so that
+          # none of our code executes. As such, all DeadZone nodes have that as
+          # their method scope
+          def method_scope
+            :contrast
+          end
         end
       end
     end

data/lib/contrast/agent/inventory.rb

@@ -0,0 +1,15 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Namespace used for inventory behavior
+    module Inventory
+    end
+  end
+end
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependency_usage_analysis'
+require 'contrast/agent/inventory/dependency_analysis'

data/lib/contrast/agent/inventory/dependencies.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # this module is included in classes that need access to the applications dependencies
+      module Dependencies
+        CONTRAST_AGENT = 'contrast-agent'
+
+        # the #clone is necessary here, as a require in another thread could
+        # potentially result in adding a key to the loaded_specs hash during
+        # iteration.  (as in RUBY-330)
+        # this takes care of filtering out contrast-only dependencies
+        def loaded_specs
+          specs = Gem.loaded_specs.clone
+          specs.delete_if { |name, _v| contrast?(name) }
+        end
+
+        private
+
+        def contrast_gems
+          @_contrast_gems ||= find_contrast_gems
+        end
+
+        def contrast? name
+          contrast_gems.include?(name)
+        end
+
+        # Go through all dependents, given as a pair from the DependencyList: `dependency`
+        # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
+        # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
+        # then contrast depends on it. If its array of dependents is 1, then contrast is the
+        # only dependency in that list. Since only contrast depends on it, we should ignore it.
+        def find_contrast_gems
+          ignore = Set.new([CONTRAST_AGENT])
+          contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
+            dependency.name == CONTRAST_AGENT
+          end
+          contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
+
+          Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
+            ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
+          end
+          ignore
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to collect dependencies of the application for reporting
+      class DependencyAnalysis
+        include Singleton
+        include Contrast::Agent::Inventory::Dependencies
+        include Contrast::Components::Interface
+
+        access_component :analysis
+
+        # Report the dependencies of this application
+        #
+        # @return [Array<Contrast::Api::Dtm::Library>] protobuf form of the
+        #   Gem::Specification that have been loaded for this application.
+        def library_pb_list
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.enabled?
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless INVENTORY.analyze_libraries?
+
+          loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
+            next unless spec
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            reported_lib_list << Contrast::Api::Dtm::Library.build(digest, spec)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,104 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/inventory/gemfile_digest_cache'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Interface
+        include Contrast::Agent::Inventory::Dependencies
+
+        access_component :analysis, :config, :logging
+
+        def initialize
+          return unless enabled?
+
+          @gemdigest_cache = Contrast::Agent::Inventory::GemfileDigestCache.new
+        end
+
+        # This method is invoked once, along with the rest of our catchup code
+        # to report libraries and their associated files that have already been loaded pre-contrast
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            @gemdigest_cache.use_cache(digest) do |existing_files|
+              loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+              loaded_files_from_gem.each do |file_path|
+                logger.trace('Recording loaded file for inventory analysis', line: file_path)
+                existing_files << adjust_path_for_reporting(file_path, spec)
+              end
+            end
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific
+        # file being required to the gem it belongs to
+        #
+        # @param path [String] the result of TracePoint#path from the :end
+        #   event in which the Module was defined
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @gemdigest_cache.get(digest) << report_path
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages filed of the Activity message using the
+        # data stored in the @gemdigest_cache
+        #
+        # @param activity [Contrast::Api::Dtm::Activity] the message to which
+        #   to append the usage data
+        def generate_library_usage activity
+          return unless enabled?
+          return if @gemdigest_cache.empty?
+
+          @gemdigest_cache.generate_usage_data(activity)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..-1] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = INVENTORY.enabled? && INVENTORY.analyze_libraries? if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/gemfile_digest_cache.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Inventory
+      # Keeps a map of gem digest to files for reporting file usage
+      class GemfileDigestCache
+        extend Forwardable
+        def_delegator :@gem_spec_digest_to_files,
+                      :empty?
+
+        def initialize
+          @gem_spec_digest_to_files = {}
+        end
+
+        def generate_usage_data activity
+          return unless activity
+
+          @gem_spec_digest_to_files.each_pair do |digest, files|
+            usage = Contrast::Api::Dtm::LibraryUsageUpdate.build(digest, files)
+            activity.library_usages[usage.hash_code] = usage if activity
+          end
+          @gem_spec_digest_to_files.clear
+        end
+
+        def use_cache digest
+          yield get(digest)
+        end
+
+        def get digest
+          @gem_spec_digest_to_files[digest] = Set.new unless @gem_spec_digest_to_files.key?(digest)
+          @gem_spec_digest_to_files[digest]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/middleware.rb

@@ -79,7 +79,7 @@ module Contrast
         Contrast::Utils::HeapDumpUtil.run
 
         if AGENT.enabled?
-          Contrast::Agent::StaticAnalysis.catchup
+          handle_first_request
           call_with_agent(env)
         else
           app.call(env)
@@ -91,17 +91,47 @@ module Contrast
       def setup_agent
         SETTINGS.reset_state
 
+        inform_deprecations
+
         if CONFIG.invalid?
           AGENT.disable!
           logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif CONFIG.disabled?
-          AGENT.disable!
+        elsif AGENT.disabled?
           logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
         else
           AGENT.enable!
         end
       end
 
+      # Some things have to wait until first request to happen, either because
+      # resolution is not complete or because the framework will preload
+      # classes, which confuses some of our instrumentation.
+      def handle_first_request
+        @_handle_first_request ||= begin
+          Contrast::Agent::StaticAnalysis.catchup
+          force_patching
+          true
+        end
+      end
+
+      # TODO: RUBY-1090 remove this method and those it calls.
+      #
+      # These modules are auto-loaded by Rails, meaning they are defined at
+      # startup, but that they don't actually exist. We account for this in
+      # most cases by using the ClassUtil.truly_defined? method, but it appears
+      # to fail for these Modules. In the short term, we can forcing a re-patch
+      # so that their dead zones apply.
+      def force_patching
+        force_patch(ActionDispatch::FileHandler) if defined?(ActionDispatch::FileHandler)
+        force_patch(ActionDispatch::Http::MimeNegotiation) if defined?(ActionDispatch::Http::MimeNegotiation)
+        force_patch(ActionView::Template) if defined?(ActionView::Template)
+      end
+
+      def force_patch mod
+        data = Contrast::Agent::ModuleData.new(mod)
+        Contrast::Agent::Patching::Policy::Patcher.send(:patch_into_module, data, true)
+      end
+
       # This is where we process each request we intercept as a middleware. We make the request context
       # available globally so that it can be accessed from anywhere. A RequestHandler object is made
       # for each request, which handles prefilter and postfilter operations.
@@ -174,6 +204,24 @@ module Contrast
           raise exception
         end
       end
+
+      # As we deprecate support to prepare to remove dead code, we need to
+      # inform our users still relying on the now deprecated and soon to be
+      # removed functionality. This method handles doing that by leveraging the
+      # standard Kernel#warn approach
+      def inform_deprecations
+        # Ruby 2.5 is currently in security maintenance, meaning int is only
+        # receiving updates for security issues. It will move to eol on 31
+        # March 2021. As such, we can remove support for it in Q2. We'll begin
+        # the deprecation warnings now so that customers have time to reach out
+        # if they'll be impacted.
+        # TODO: RUBY-715 remove this part of the method, leaving it empty if
+        #   there are no other deprecations, when we drop 2.5 support.
+        return unless RUBY_VERSION < '2.6.0'
+
+        Kernel.warn('[Contrast Security] [DEPRECATION] Support for Ruby 2.5 will be removed in April 2021. '\
+                    'Please contact Customer Support prior if you require continued support.')
+      end
     end
   end
 end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -15,7 +15,7 @@ module Contrast
           access_component :scope
           attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
 
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module:
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
@@ -71,10 +71,10 @@ module Contrast
 
           def module_lookup
             @_module_lookup ||= begin
-                                  Module.cs__const_get module_name
-                                rescue StandardError => _e
-                                  nil
-                                end
+              Module.cs__const_get module_name
+            rescue StandardError => _e
+              nil
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -30,20 +30,20 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-                                    Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-                                    Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-                                    Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-                                    Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-                                    Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-                                    Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
-                                    Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string
-                                    Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
+              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
+              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
+              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
+              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
+              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
+              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
+              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
+              Contrast::Extension::Assess::StringPropagator.instrument_string
+              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
 
-                                    Contrast::Extension::Protect::Kernel.instrument
-                                    true
-                                  end
+              Contrast::Extension::Protect::Kernel.instrument
+              true
+            end
           end
 
           def apply_load_patches!
@@ -65,13 +65,13 @@ module Contrast
           # handling
           def apply_require_patches!
             @_apply_require_patches ||= begin
-                                          require 'contrast/extension/thread'
-                                          require 'contrast/extension/kernel'
-                                          true
-                                        rescue LoadError, StandardError => e
-                                          logger.error('failed instrumenting apply_require_patches!', e)
-                                          false
-                                        end
+              require 'contrast/extension/thread'
+              require 'contrast/extension/kernel'
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
+            end
           end
 
           def after_load_patches

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -89,7 +89,7 @@ module Contrast
             end
 
             def find_method_node nodes, method_name, is_instance_method
-              return nil unless nodes
+              return unless nodes
 
               nodes.find do |node|
                 node.instance_method? == is_instance_method && node.method_name == method_name