contrast-agent 3.15.0 → 4.3.0

data/lib/contrast/agent/static_analysis.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/interface'
-require 'contrast/utils/gemfile_reader'
+require 'contrast/agent/inventory'
 require 'contrast/api/decorators/application_update'
 
 module Contrast
@@ -17,14 +17,9 @@ module Contrast
         # report the already-loaded gems.
         def catchup
           @_catchup ||= begin
-                          with_contrast_scope do
-                            Contrast::Utils::GemfileReader.instance.map_loaded_classes
-                            send_inventory_message
-                            true
-                          end
-                        end
-        rescue StandardError => e
-          logger.warn('Unable to run post-initialization static analysis', e)
+            threaded_analysis!
+            true
+          end
         end
 
         def send_inventory_message
@@ -35,6 +30,17 @@ module Contrast
           Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
           Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
         end
+
+        private
+
+        def threaded_analysis!
+          Contrast::Agent::Thread.new do
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.catchup
+            send_inventory_message
+          rescue StandardError => e
+            logger.warn('Unable to run post-initialization static analysis', e)
+          end
+        end
       end
     end
   end

data/lib/contrast/agent/tracepoint_hook.rb

@@ -35,7 +35,7 @@ module Contrast
             path = tracepoint_event.path
             return if path&.include?('contrast')
 
-            Contrast::Utils::InventoryUtil.inventory_class(path) if path
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.associate_file(path) if path
             Contrast::Agent::Patching::Policy::Patcher.patch_specific_module(loaded_module)
             Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolation(loaded_module)
             Contrast::Agent::Assess::Policy::PolicyScanner.scan(tracepoint_event)

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.15.0'
+    VERSION = '4.3.0'
   end
 end

data/lib/contrast/api/communication/socket_client.rb

@@ -15,7 +15,7 @@ module Contrast
       # service proxy and tracks the state of that proxy.
       class SocketClient
         include Contrast::Components::Interface
-        access_component :contrast_service, :logging
+        access_component :config, :contrast_service, :logging
 
         def initialize
           @socket = init_connection
@@ -34,6 +34,7 @@ module Contrast
         private
 
         def init_connection
+          log_connection
           if CONTRAST_SERVICE.use_tcp?
             Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
           else
@@ -41,6 +42,40 @@ module Contrast
           end
         end
 
+        def log_connection
+          # The socket is set,
+          if CONFIG.root.agent.service.socket
+            logger.info('Connecting to the Contrast Service using a UnixSocket socket',
+                        socket: CONTRAST_SERVICE.socket_path)
+            return
+          end
+          # The host & port are set,
+          if CONFIG.root.agent.service.host && CONFIG.root.agent.service.port
+            logger.info('Connecting to the Contrast Service using a TCP socket',
+                        host: CONTRAST_SERVICE.host,
+                        port: CONTRAST_SERVICE.port)
+            return
+          end
+
+          # Or something is not set.
+          msg = if CONFIG.root.agent.service.host
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.port` is not set. ' \
+                  'Falling back to default TCP socket port.'
+                elsif CONFIG.root.agent.service.port
+                  'Missing a required connection value to the Contrast Service. ' \
+                  '`agent.service.host` is not set. ' \
+                  'Falling back to default TCP socket host.'
+                else
+                  'Missing a required connection value to the Contrast Service. ' \
+                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+                  'Falling back to default TCP socket.'
+                end
+          logger.warn(msg,
+                      host: CONTRAST_SERVICE.host,
+                      port: CONTRAST_SERVICE.port)
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/decorators.rb

@@ -8,11 +8,14 @@ module Contrast
     end
   end
 end
+
 require 'contrast/api/decorators/message'
 require 'contrast/api/decorators/application_update'
 require 'contrast/api/decorators/input_analysis'
 require 'contrast/api/decorators/application_settings'
 require 'contrast/api/decorators/server_features'
+require 'contrast/api/decorators/library'
+require 'contrast/api/decorators/library_usage_update'
 require 'contrast/api/decorators/route_coverage'
 require 'contrast/api/decorators/trace_event_object'
 require 'contrast/api/decorators/trace_event_signature'

data/lib/contrast/api/decorators/address.rb

@@ -21,26 +21,25 @@ module Contrast
         module ClassMethods
           include Contrast::Components::Interface
           access_component :logging
-
           # receiver is memoized because it is the address/host/port of the server, once we
           # resolve this for the first time, it shouldn't change
           #
           # @return [Contrast::Api::Dtm::Address] the address of this server
           def build_receiver
             @_build_receiver ||= begin
-                             address = new
-                             address.host = 'localhost'
-                             address.ip = '127.0.0.1'
-                             begin
-                               Timeout.timeout(1) do
-                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-                               end
-                             rescue StandardError => e
-                               logger.warn('Unable to resolve host or ip', e, address: address)
-                             end
-                             address
-                           end
+              address = new
+              address.host = 'localhost'
+              address.ip = '127.0.0.1'
+              begin
+                Timeout.timeout(1) do
+                  address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                  address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                end
+              rescue StandardError => e
+                logger.warn('Unable to resolve host or ip', e, address: address)
+              end
+              address
+            end
           end
 
           # Parse out the sender of the Request and return it as an Address

data/lib/contrast/api/decorators/application_update.rb

@@ -44,7 +44,7 @@ module Contrast
             msg = new
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
-            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list)
+            msg.append_library_update(Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list)
             msg
           end
         end

data/lib/contrast/api/decorators/library.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/sha256_builder'
+require 'yaml'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Library protobuf model to handle Gem::Specification translation
+      module Library
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the Library class on inclusion of the decorator
+        module ClassMethods
+          def build digest, gem_specification
+            msg = new
+            msg.file_path = Contrast::Utils::StringUtils.force_utf8(gem_specification.name)
+            msg.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
+            msg.version     = Contrast::Utils::StringUtils.force_utf8(gem_specification.version)
+            msg.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(gem_specification))
+            msg.external_ms = date_to_ms(gem_specification.date)
+            msg.internal_ms = msg.external_ms
+            msg.url         = Contrast::Utils::StringUtils.force_utf8(gem_specification.homepage)
+            msg.class_count = file_count(gem_specification.full_gem_path.to_s)
+            msg.used_class_count = 0
+            msg
+          end
+
+          # These are all the code files that are located in the Gem directory loaded
+          # by the current environment; this includes more than Ruby files
+          def file_count path
+            Contrast::Utils::Sha256Builder.instance.files(path).length
+          end
+
+          def build_manifest spec
+            Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s)
+          rescue StandardError
+            nil
+          end
+
+          def date_to_ms date
+            (date.to_f * 1000.0).to_i
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Library.include(Contrast::Api::Decorators::Library)

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the LibraryUsageUpdate protobuf
+      module LibraryUsageUpdate
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the LibraryUsageUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build digest, files
+            msg = new
+            msg.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
+            files.each do |required_file|
+              msg.class_names[required_file] = true
+            end
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::LibraryUsageUpdate.include(Contrast::Api::Decorators::LibraryUsageUpdate)

data/lib/contrast/api/decorators/message.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/utils/object_share'
 require 'contrast/utils/string_utils'
 
 module Contrast

data/lib/contrast/api/decorators/trace_event.rb

@@ -15,42 +15,45 @@ module Contrast
 
         # Wrapper around build_event_object for the args array. Handles
         # tainting the correct argument.
-        def build_event_args contrast_event, taint_target
+        def build_event_args! contrast_event, taint_target
           contrast_event.args.each_index do |idx|
             truncate_arg = taint_target != idx
             event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
             args << event_arg
           end
+          self
         end
 
-        # TeamServer only supports one object's taint ranges at a time.
-        # We'll find the taint ranges for the target and return those
-        def build_taint_ranges contrast_event, taint_target
+        # TeamServer only supports one object's taint ranges at a time. We keep
+        # those tags on the event directly, so we just need to convert them to
+        # their DTM form in order to report this.
+        #
+        # @param contrast_event [Contrast::Agent::AssessContrastEvent]
+        def build_taint_ranges! contrast_event
           # If there's no taint_target, this isn't a dataflow trace, but a
           # trigger one
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless taint_target
+          return self unless contrast_event&.tags
 
-          properties = case taint_target
-                       when Contrast::Utils::ObjectShare::OBJECT_KEY
-                         Contrast::Agent::Assess::Tracker.properties(contrast_event.object)
-                       when Contrast::Utils::ObjectShare::RETURN_KEY
-                         Contrast::Agent::Assess::Tracker.properties(contrast_event.ret)
-                       else
-                         target = contrast_event.args[taint_target]
-                         if target.is_a?(Hash)
-                           if contrast_event.policy_node&.targets&.any?
-                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.targets[0]])
-                           else
-                             Contrast::Agent::Assess::Tracker.properties(target[contrast_event.policy_node.sources[0]])
-                           end
-                         else
-                           Contrast::Agent::Assess::Tracker.properties(target)
-                         end
-                       end
+          self.taint_ranges += Contrast::Api::Dtm::TraceTaintRange.build_for_event(contrast_event.tags)
+          self
+        end
+
+        def build_parent_ids! contrast_event
+          contrast_event&.parent_events&.each do |event|
+            next unless event
 
-          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+            parent = Contrast::Api::Dtm::ParentObjectId.new
+            parent.id = event.event_id.to_i
+            parent_object_ids << parent
+          end
+          self
+        end
 
-          properties.tags_to_dtm
+        def build_stack! contrast_event
+          # We delayed doing this as long as possible b/c it's expensive
+          stack_dtms = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+          self.stack += stack_dtms
+          self
         end
 
         # Class methods for TraceEvent
@@ -70,24 +73,11 @@ module Contrast
             event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
             truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
             event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
-            event_dtm.build_event_args(contrast_event, taint_target)
-
-            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
-            taint_ranges.each do |range|
-              event_dtm.taint_ranges << range
-            end
-
-            # We delayed doing this as long as possible b/c it's expensive
-            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
-            event_dtm.stack += stack
-
+            event_dtm.build_event_args!(contrast_event, taint_target)
+            event_dtm.build_parent_ids!(contrast_event)
+            event_dtm.build_taint_ranges!(contrast_event)
+            event_dtm.build_stack!(contrast_event)
             event_dtm.object_id = contrast_event.event_id.to_i
-            contrast_event.parent_ids&.each do |id|
-              parent = Contrast::Api::Dtm::ParentObjectId.new
-              parent.id = id.to_i
-              event_dtm.parent_object_ids << parent
-            end
-
             event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
             event_dtm
           end

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -29,13 +29,21 @@ module Contrast
           ELLIPSIS = '...'
           UNTRUNCATED_PORTION_LENGTH = 25
           TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
-          def build object, truncate
+
+          # Convert the given Object into a Contrast::Api::Dtm::TraceEventObject
+          #
+          # @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
+          #   the thing to convert, if any
+          # @param truncate [Boolean] if the converted object can/should be
+          #   truncated.
+          # @return [Contrast::Api::Dtm::TraceEventObject]
+          def build contrast_object, truncate
             event_object = new
             with_contrast_scope do
-              obj_string = Contrast::Utils::StringUtils.force_utf8(object)
+              obj_string = Contrast::Utils::StringUtils.force_utf8(contrast_object&.object)
               obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
               event_object.value = Base64.encode64(obj_string)
-              event_object.tracked = Contrast::Utils::Assess::TrackingUtil.tracked?(object)
+              event_object.tracked = contrast_object&.tracked?
             end
             event_object
           end

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -17,27 +17,49 @@ module Contrast
 
         # Class methods for TraceEventSignature
         module ClassMethods
+          # Convert the given composites into components that TeamServer can
+          # understand in order to build a representation of the method
+          # invoked.
+          #
+          # @param ret_obj [Contrast::Agent::Assess::ContrastObject, nil] the
+          #   return value of the method call.
+          # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode]
+          #   the policy which pertains to the method invoked.
+          # @param args [Array<Contrast::Agent::Assess::ContrastObject>, nil]
+          # @return [Contrast::Api::Dtm::TraceEventSignature]
           def build ret_obj, policy_node, args
             signature = new
-            return_type = ret_obj ? ret_obj.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
-            signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
+            signature.return_type = Contrast::Utils::StringUtils.force_utf8(type_name(ret_obj))
             signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
             signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
             if args
               args&.each do |arg|
-                arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
-                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
+                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(type_name(arg))
               end
             end
             signature.constructor = policy_node.method_name == :new
             # if there's a ret, then this method isn't nil. not 100% full proof since you can
             # return nil, but this is the best we've got currently.
-            signature.void_method = ret_obj.nil?
+            signature.void_method = ret_obj.nil? || ret_obj.object.nil?
             # 8 is STATIC in Java... we have to placate them for now
             # it has been requested that flags be removed since it isn't used
             signature.flags = 8 unless policy_node.instance_method?
             signature
           end
+
+          private
+
+          # While Ruby signatures do not require neither a return type and can
+          # return anything depending on inputs, code paths, etc, nor constant
+          # parameter types, TeamServer was designed with strongly typed
+          # languages (Java) in mind, so we need types in our signatures.
+          #
+          # @param contrast_object [Contrast::Agent::Assess::ContrastObject, nil]
+          #   the object to find the type of
+          # @return [String] the name of the module of the ret_obj, or `nil`
+          def type_name contrast_object
+            contrast_object ? contrast_object.object_type : Contrast::Utils::ObjectShare::NIL_STRING
+          end
         end
       end
     end