contrast-agent 3.16.0 → 4.3.1

data/resources/protect/policy.json

@@ -379,6 +379,18 @@
           "method_visibility": "public",
           "applicator_method": "apply_rule__io",
           "properties": {}
+        },{
+          "class_name": "Nokogiri::XML::Document",
+          "method_name": "parse",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Nokogiri::XML::SAX::Parser",
+          "method_name": "parse",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {}
         },{
           "class_name": "Nokogiri::XML::SAX::Parser",
           "method_name": "parse_memory",

data/ruby-agent.gemspec

@@ -14,12 +14,14 @@ def self.add_authors spec
     donald.propst@contrastsecurity.com
     alex.macdonald@contrastsecurity.com
     mark.petersen@contrastsecurity.com
+    joshua.reed@contrastsecurity.com
   ]
 end
 
 # Add those dependencies required to develop or test the Agent
 def self.add_dev_dependencies spec
   spec.add_development_dependency 'amazing_print'
+  spec.add_development_dependency 'benchmark-ips'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'climate_control' # mock ENV
   spec.add_development_dependency 'debase'
@@ -33,16 +35,18 @@ def self.add_dev_dependencies spec
   spec.add_development_dependency 'parser', '~> 2.6'
   spec.add_development_dependency 'pry'
   spec.add_development_dependency 'rails', '>= 3'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rake', '>= 12.3.3'
   spec.add_development_dependency 'rake-compiler', '~> 0'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rspec-benchmark'
   spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
-  spec.add_development_dependency 'rubocop', '0.93.1'
-  spec.add_development_dependency 'rubocop-performance', '1.8.1'
-  spec.add_development_dependency 'rubocop-rspec', '1.43.2'
+  spec.add_development_dependency 'rubocop', '1.6.1'
+  spec.add_development_dependency 'rubocop-performance', '1.9.1'
+  spec.add_development_dependency 'rubocop-rails', '2.9.1'
+  spec.add_development_dependency 'rubocop-rake', '0.5.1'
+  spec.add_development_dependency 'rubocop-rspec', '2.1.0'
   spec.add_development_dependency 'ruby-debug-ide'
-  spec.add_development_dependency 'simplecov', '~> 0.18'
+  spec.add_development_dependency 'simplecov', '0.20.0'
   spec.add_development_dependency 'sinatra', '>= 2'
   spec.add_development_dependency 'sqlite3', '1.3.9'
   spec.add_development_dependency 'therubyracer'
@@ -58,7 +62,7 @@ end
 # corresponding update to the fake gem server data in TeamServer.
 def self.add_dependencies spec
   spec.add_dependency 'ougai', '~> 1.8'
-  spec.add_dependency 'parser', '~> 2.6'
+  spec.add_dependency 'parser', '~> 2.6' # TODO: RUBY-714 remove w/ EOL of 2.5
   spec.add_dependency 'protobuf', '~> 3.10'
   spec.add_dependency 'rack', '~> 2.0'
 end

data/service_executables/VERSION

@@ -1 +1 @@
-2.14.3
+2.17.2

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 3.16.0
+  version: 4.3.1
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -9,10 +9,11 @@ authors:
 - donald.propst@contrastsecurity.com
 - alex.macdonald@contrastsecurity.com
 - mark.petersen@contrastsecurity.com
+- joshua.reed@contrastsecurity.com
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-26 00:00:00.000000000 Z
+date: 2021-02-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: amazing_print
@@ -28,6 +29,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: benchmark-ips
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -214,16 +229,16 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rake-compiler
   requirement: !ruby/object:Gem::Requirement
@@ -286,42 +301,70 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.1
+        version: 1.6.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.93.1
+        version: 1.6.1
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.8.1
+        version: 1.9.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.8.1
+        version: 1.9.1
+- !ruby/object:Gem::Dependency
+  name: rubocop-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.9.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.9.1
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.5.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.5.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.43.2
+        version: 2.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.43.2
+        version: 2.1.0
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement
@@ -340,16 +383,16 @@ dependencies:
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
-        version: '0.18'
+        version: 0.20.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
-        version: '0.18'
+        version: 0.20.0
 - !ruby/object:Gem::Dependency
   name: sinatra
   requirement: !ruby/object:Gem::Requirement
@@ -498,20 +541,20 @@ executables:
 - contrast_service
 extensions:
 - ext/cs__common/extconf.rb
+- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_module/extconf.rb
-- ext/cs__protect_kernel/extconf.rb
-- ext/cs__assess_array/extconf.rb
-- ext/cs__assess_hash/extconf.rb
 - ext/cs__assess_marshal_module/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
+- ext/cs__assess_hash/extconf.rb
+- ext/cs__assess_array/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__protect_kernel/extconf.rb
 - ext/cs__assess_string/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_active_record_named/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
-- ext/cs__assess_string_interpolation26/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
@@ -708,6 +751,7 @@ files:
 - lib/contrast/agent.rb
 - lib/contrast/agent/assess.rb
 - lib/contrast/agent/assess/contrast_event.rb
+- lib/contrast/agent/assess/contrast_object.rb
 - lib/contrast/agent/assess/events/event_factory.rb
 - lib/contrast/agent/assess/events/source_event.rb
 - lib/contrast/agent/assess/finalizers/freeze.rb
@@ -770,6 +814,11 @@ files:
 - lib/contrast/agent/deadzone/policy/policy.rb
 - lib/contrast/agent/disable_reaction.rb
 - lib/contrast/agent/exclusion_matcher.rb
+- lib/contrast/agent/inventory.rb
+- lib/contrast/agent/inventory/dependencies.rb
+- lib/contrast/agent/inventory/dependency_analysis.rb
+- lib/contrast/agent/inventory/dependency_usage_analysis.rb
+- lib/contrast/agent/inventory/gemfile_digest_cache.rb
 - lib/contrast/agent/inventory/policy/datastores.rb
 - lib/contrast/agent/inventory/policy/policy.rb
 - lib/contrast/agent/inventory/policy/trigger_node.rb
@@ -847,6 +896,8 @@ files:
 - lib/contrast/api/decorators/application_update.rb
 - lib/contrast/api/decorators/http_request.rb
 - lib/contrast/api/decorators/input_analysis.rb
+- lib/contrast/api/decorators/library.rb
+- lib/contrast/api/decorators/library_usage_update.rb
 - lib/contrast/api/decorators/message.rb
 - lib/contrast/api/decorators/rasp_rule_sample.rb
 - lib/contrast/api/decorators/route_coverage.rb
@@ -941,11 +992,9 @@ files:
 - lib/contrast/tasks/service.rb
 - lib/contrast/utils/assess/sampling_util.rb
 - lib/contrast/utils/assess/tracking_util.rb
-- lib/contrast/utils/boolean_util.rb
 - lib/contrast/utils/class_util.rb
 - lib/contrast/utils/duck_utils.rb
 - lib/contrast/utils/env_configuration_item.rb
-- lib/contrast/utils/gemfile_reader.rb
 - lib/contrast/utils/hash_digest.rb
 - lib/contrast/utils/heap_dump_util.rb
 - lib/contrast/utils/invalid_configuration_util.rb

data/lib/contrast/utils/boolean_util.rb

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'contrast/utils/object_share'
-
-module Contrast
-  module Utils
-    # Utility methods for asserting truthy or falsy state of a value expected
-    # to equate to a boolean
-    class BooleanUtil
-      class << self
-        def false? config
-          return false if config == true
-          return true if config == false
-          return false unless config.cs__is_a?(String)
-
-          Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
-        end
-
-        def true? config
-          return false if config == false
-          return true if config == true
-          return false unless config.cs__is_a?(String)
-
-          Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/gemfile_reader.rb

@@ -1,193 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-require 'set'
-require 'contrast/utils/sha256_builder'
-require 'contrast/utils/string_utils'
-require 'contrast/components/interface'
-require 'contrast/api'
-
-module Contrast
-  module Utils
-    # GemfileReader has methods for extracting information from gem specs
-    # it also has a cache of library file digests to the lines of code found.
-    class GemfileReader
-      include Singleton
-      include Contrast::Components::Interface
-
-      access_component :config, :logging
-
-      CONTRAST_AGENT = 'contrast-agent'
-
-      def initialize
-        # Map of a Gem's Spec Digest to all loaded files from that Gem
-        @spec_to_files = {}
-      end
-
-      # the #clone is necessary here, as a require in another thread could
-      # potentially result in adding a key to the loaded_specs hash during
-      # iteration.  (as in RUBY-330)
-      def loaded_specs
-        Gem.loaded_specs.clone
-      end
-
-      # indicates if there's been an update to library information, allowing us
-      # to only serialize this information on change.
-      def updated?
-        @updated
-      end
-
-      def updated!
-        @updated = true
-      end
-
-      # Once we're Contrasted, we intercept require calls to do inventory.
-      # In order to catch up, we do a one-time manual catchup, & inventory
-      # all the already-loaded gems.
-      def map_loaded_classes
-        loaded_specs.each do |name, spec|
-          # Don't count Contrast gems
-          next if contrast_gems.include? name
-
-          # Get a digest of the Gem file itself
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          paths = get_by_digest(digest)
-          path = spec.full_gem_path
-          $LOADED_FEATURES.each do |line|
-            next unless line.cs__is_a?(String)
-            next unless line.start_with?(path)
-
-            logger.trace('Recording loaded gem for inventory analysis', line: line)
-            updated!
-            paths << adjust_lib(line)
-          end
-        end
-      end
-
-      def map_class path
-        path = adjust_lib(path)
-
-        return unless (spec   = Gem::Specification.find_by_path(path))
-        return unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-        updated!
-        get_by_digest(digest) << path
-      end
-
-      def library_pb_list
-        loaded_specs.each_with_object([]) do |(name, spec), arr|
-          next if contrast_gems.include? name
-          next unless spec
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          arr << build_library_pb(digest, spec)
-        end
-      end
-
-      def generate_library_usage activity = nil
-        return unless updated?
-
-        @spec_to_files.each_pair do |digest, files|
-          usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
-          usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
-          activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: RUBY-882 once TS switches to take filenames, remove the count setter and
-          #   send the class names in usage.class_names
-          usage.count = files.size
-        end
-        # TODO: RUBY-882 once TS switches to take filenames, clear this and remove the
-        #   @updated variable
-
-        # @spec_to_files.clear
-        @updated = false
-      end
-
-      private
-
-      # marker for the lib dir in an absolute file path. purposefully includes
-      # the trailing '/'
-      LIB = '/lib/'
-
-      # Kernel#load uses the absolute path, but Gems / Specs use the path after
-      # `/lib`. This method accounts for that and trims out the `/lib/` section
-      # and starts with the first `/` after and the trailing file extension, if
-      # present.
-      #
-      # @param path [String] the path to parse
-      # @return [String] the relative path of the file, after the lib directory
-      def adjust_lib path
-        idx = path.index(LIB)
-        path = path[(idx + 4)..-1] if idx
-        idx = path.rindex(Contrast::Utils::ObjectShare::PERIOD)
-        path = path[0..idx] if idx
-        path
-      end
-
-      def get_by_digest digest
-        @spec_to_files[digest] = Set.new unless @spec_to_files.key?(digest)
-        @spec_to_files[digest]
-      end
-
-      def build_library_pb digest, spec
-        lib             = Contrast::Api::Dtm::Library.new
-        lib.file_path   = Contrast::Utils::StringUtils.force_utf8(spec.name)
-        lib.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
-        lib.version     = Contrast::Utils::StringUtils.force_utf8(spec.version)
-        lib.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(spec))
-        lib.external_ms = date_to_ms(spec.date)
-        lib.internal_ms = lib.external_ms
-        lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
-        # Library tags are appended in the ApplicationUpdate delegator
-        update_class_counts(lib, digest, spec)
-        lib
-      end
-
-      def date_to_ms date
-        (date.to_f * 1000.0).to_i
-      end
-
-      def update_class_counts lib, digest, spec
-        # Updating the class counts
-        path = spec.full_gem_path.to_s
-        lib.class_count = all_files(path).length
-        lib.used_class_count = @spec_to_files.key?(digest) ? get_by_digest(digest).size : 0
-        lib
-      end
-
-      def build_manifest spec
-        Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s) if defined?(YAML)
-      rescue StandardError
-        nil
-      end
-
-      # These are all the code files that are located in the Gem directory loaded
-      # by the current environment; this includes more than Ruby files
-      def all_files path
-        Contrast::Utils::Sha256Builder.instance.files(path)
-      end
-
-      # Go through all dependents, given as a pair from the DependencyList: `dependency`
-      # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
-      # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
-      # then contrast depends on it. If its array of dependents is 1, then contrast is the
-      # only dependency in that list. Since only contrast depends on it, we should ignore it.
-      def contrast_gems
-        @_contrast_gems ||= find_contrast_gems
-      end
-
-      def find_contrast_gems
-        ignore = Set.new([CONTRAST_AGENT])
-        contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
-          dependency.name == CONTRAST_AGENT
-        end
-        contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
-
-        Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
-          ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
-        end
-        ignore
-      end
-    end
-  end
-end