contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/inventory/dependency_analysis.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/library_discovery'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to collect dependencies of the application for reporting
+      class DependencyAnalysis
+        include Singleton
+        include Contrast::Agent::Inventory::Dependencies
+
+        # Report the dependencies of this application
+        #
+        # @return [Array<Contrast::Agent::Reporting::LibraryDiscovery>] direct report form of
+        #   Gem::Specification that have been loaded for this application.
+        def library_pb_list
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.enable
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless ::Contrast::INVENTORY.analyze_libraries
+
+          loaded_specs.each_with_object([]) do |(_name, spec), reported_lib_list|
+            next unless spec
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            reported_lib_list << Contrast::Agent::Reporting::LibraryDiscovery.new(digest, spec)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -0,0 +1,120 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/library_usage_observation'
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'set'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Used to analyze class usage for reporting
+      class DependencyUsageAnalysis
+        include Singleton
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Agent::Inventory::Dependencies
+
+        def initialize
+          return unless enabled?
+
+          @lock = Mutex.new
+          @lock.synchronize { @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new } }
+        end
+
+        # This method is invoked once, along with the rest of our catchup code to report libraries and their associated
+        # files that have already been loaded pre-contrast.
+        def catchup
+          return unless enabled?
+
+          loaded_specs.each do |_name, spec|
+            # Get a digest of the Gem file itself.
+            next unless (digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec))
+
+            loaded_files_from_gem = $LOADED_FEATURES.select { |f| f.start_with?(spec.full_gem_path) }
+
+            new_files = loaded_files_from_gem.each_with_object(Set.new) do |file_path, set|
+              set << adjust_path_for_reporting(file_path, spec)
+              logger.trace('Recording loaded file for inventory analysis', line: file_path)
+            end
+
+            # Even if new_files is empty, still need to add digest key for library discovery.
+            @lock.synchronize { @gemdigest_cache[digest].merge(new_files) }
+          end
+        end
+
+        # This method is invoked once per TracePoint :end - to map a specific file being required to the gem to which
+        # it belongs.
+        #
+        # @param path [String] the result of TracePoint#path from the :end event in which the Module was defined.
+        def associate_file path
+          return unless enabled?
+
+          spec_lookup_path = adjust_path_for_spec_lookup(path)
+          spec = Gem::Specification.find_by_path(spec_lookup_path)
+          unless spec
+            logger.debug('Unable to resolve gem spec for path', path: path)
+            return
+          end
+
+          digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
+          unless digest
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s) if logger.debug?
+            return
+          end
+          report_path = adjust_path_for_reporting(path, spec)
+          @lock.synchronize { @gemdigest_cache[digest] << report_path }
+        rescue StandardError => e
+          logger.error('Unable to inventory file path', e, path: path)
+        end
+
+        # Populate the library_usages field of the Activity message using the data stored in the @gemdigest_cache. If
+        # no libraries had files loaded, or inventory analysis is disabled, return nil instead.
+        #
+        # @return [Contrast::Agent::Reporting::ObservedLibraryUsage, nil]
+        def generate_library_usage
+          return unless enabled?
+          return unless @gemdigest_cache.any?
+
+          # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
+          # assignment and the replace
+          gem_spec_digest_to_files = @lock.synchronize do
+            hold = @gemdigest_cache
+            @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
+            hold
+          end
+
+          observed_library_usage = Contrast::Agent::Reporting::ObservedLibraryUsage.new
+          gem_spec_digest_to_files.each_pair do |digest, files|
+            next unless files.any?
+
+            usage = Contrast::Agent::Reporting::LibraryUsageObservation.new(digest, files)
+            observed_library_usage.observations << usage
+          end
+          observed_library_usage.observations.any? ? observed_library_usage : nil
+        rescue StandardError => e
+          logger.error('Unable to generate library usage.', e)
+        end
+
+        private
+
+        def adjust_path_for_spec_lookup path
+          idx = path.index('/lib/')
+          path = path[(idx + 4)..] if idx
+          path
+        end
+
+        def adjust_path_for_reporting path, gem_spec
+          path.delete_prefix(gem_spec.full_gem_path)
+        end
+
+        # We only use this if inventory and library analysis are enabled
+        def enabled?
+          @_enabled = ::Contrast::INVENTORY.enable && ::Contrast::INVENTORY.analyze_libraries if @_enabled.nil?
+          @_enabled
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/inventory/database_config'
+
+module Contrast
+  module Agent
+    module Inventory
+      module Policy
+        # This Module is how we apply the Data Store detection required for the
+        # FlowMap feature. It is called from our patches of the targeted methods
+        # in which database operations occur. It is responsible for deciding if
+        # the given invocation is worth reporting or not.
+        module DataStores
+          extend Contrast::Components::Logger::InstanceMethods
+          class << self
+            # The key used in policy.json to indicate the database type to
+            # report.
+            DATA_STORE_MARKER = 'data_store'
+
+            def report_data_store _method, _exception, properties, object, _args
+              return unless ::Contrast::INVENTORY.enable
+
+              marker = properties[DATA_STORE_MARKER]
+              return unless marker
+
+              file_report(marker)
+            rescue StandardError => e
+              logger.error('Error reporting database call', e, object: object)
+            end
+
+            private
+
+            def file_report data_store
+              return unless data_store
+
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              return unless context&.activity
+
+              context.activity.query_count += 1
+              return unless context.activity.query_count == 1
+
+              Contrast::Agent::Inventory::DatabaseConfig.append_db_config(context.activity)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,11 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/inventory/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/core_extensions/inventory/datastores'
+require 'contrast/agent/inventory/policy/datastores'
 
 module Contrast
   module Agent
@@ -19,7 +19,7 @@ module Contrast
           end
 
           def disabled_globally?
-            !INVENTORY.enabled?
+            !::Contrast::INVENTORY.enable
           end
 
           def node_type

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/inventory.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Namespace used for inventory behavior
+    module Inventory
+    end
+  end
+end
+
+require 'contrast/agent/inventory/dependencies'
+require 'contrast/agent/inventory/dependency_usage_analysis'
+require 'contrast/agent/inventory/dependency_analysis'