contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/rails_extensions/assess/configuration.rb

@@ -1,26 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: false
-
-if defined?(Rails) && defined?(Rails::Application) && defined?(Rails::Application::Configuration)
-  module Rails
-    class Application
-      # Our patch into the Rails::Application::Configuration Class, allowing
-      # for the runtime detection of insecure configurations on individual
-      # ActionDispatch::Session::AbstractStore instances within the
-      # application.
-      class Configuration
-        include Contrast::Utils::InvalidConfigurationUtil
-        include Contrast::Components::Interface
-
-        access_component :analysis, :scope
-
-        alias_method :cs__patched_session_store, :session_store
-        def session_store *args
-          ret = cs__patched_session_store(*args)
-          Contrast::Utils::RailsAssessConfiguration.analyze_session_store(*args)
-          ret
-        end
-      end
-    end
-  end
-end

data/lib/contrast/rails_extensions/buffer.rb

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-if defined?(ActionController) && defined?(ActionController::Live) && defined?(ActionController::Live::Buffer)
-  module ActionController
-    module Live
-      # This class acts as our patch into the ActionController::Live::Buffer
-      # class, allowing us to track the close event on streamed responses.
-      class Buffer
-        include Contrast::Components::Interface
-        access_component :contrast_service
-
-        # normally pre->in->post filters are applied however, in a streamed response
-        # we can run into a case where it's pre -> in -> post -> more infilters
-        # in order to submit anything found during the infilters after the response has been written we need to explicity send them
-        alias_method :cs__close, :close
-        def close
-          if (context = Contrast::Agent::REQUEST_TRACKER.current)
-            [context.server_activity, context.activity, context.observed_route].each do |msg|
-              CONTRAST_SERVICE.send_message msg
-            end
-          end
-          cs__close
-        end
-      end
-    end
-  end
-end

data/lib/contrast/rails_extensions/rack.rb

@@ -1,45 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-if defined?(Rack)
-  # In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-  # not have get_header or set_header methods. This is our way of working
-  # around that.
-  module Rack
-    if defined?(Rack::Request)
-      # Our patch into the Rack::Request class, allowing us to call set_header
-      # and get_header in our code without worrying about older versions of
-      # Rack not implementing these methods.
-      class Request
-        unless Rack::Request.instance_methods(true).include?(:set_header)
-          def set_header name, value
-            @env[name] = value
-          end
-        end
-        unless Rack::Request.instance_methods(true).include?(:get_header)
-          def get_header name
-            @env[name]
-          end
-        end
-      end
-    end
-
-    if defined?(Rack::Response)
-      # Our patch into the Rack::Response Class, allowing us to call set_header
-      # and get_header in our code without worrying about older versions of
-      # Rack not implementing these methods.
-      class Response
-        unless Rack::Response.instance_methods(true).include?(:set_header)
-          def set_header key, value
-            headers[key] = value
-          end
-        end
-        unless Rack::Response.instance_methods(true).include?(:get_header)
-          def get_header key
-            headers[key]
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/sinatra_extensions/assess/cookie.rb

@@ -1,26 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-if defined?(Rack) && defined?(Rack::Session) && defined?(Rack::Session::Cookie)
-  module Rack
-    module Session
-      # Our patch into the Rack::Session::Cookie Class, allowing for the
-      # runtime detection of insecure configurations on individual cookies
-      # within the application
-      class Cookie
-        include Contrast::Utils::InvalidConfigurationUtil
-        include Contrast::Components::Interface
-
-        access_component :scope
-
-        alias_method :cs__patched_initialize, :initialize
-        def initialize app, options = {}
-          Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
-          cs__patched_initialize(app, options)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb

@@ -1,59 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-if defined?(Sinatra) && defined?(Sinatra::Base)
-  module Sinatra
-    # Our patch into the Sinatra::Base Class, allowing for the inventory of the
-    # routes called by the application
-    class Base
-      alias_method :cs__patched_call!, :call!
-
-      # publicly available method for Sinatra::Base things -- unfortunately,
-      # getting the routes appear to require a lookup every time
-      def call! *args
-        cs__patched_map_route(*args)
-        cs__patched_call!(*args)
-      end
-
-      private
-
-      # Use logic copied from Sinatra::Base#process_route to determine which
-      # pattern matches the request being invoked by Sinatra::Base#call!
-      #
-      # @param args [Array<Object>] we rely on the @settings object in
-      #   Sinatra::Base and the env variable passed in as args[0]
-      def cs__patched_map_route *args
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context
-
-        env = args[0]
-        return unless env
-
-        # There isn't a Request object in the Sinatra::Base yet - it's made
-        # during the #call! method, which we're patching - so we need to
-        # access the env
-        method = env[Rack::REQUEST_METHOD]
-        route = env[Rack::PATH_INFO]
-        route = route.to_s
-
-        # get all potential routes for this request type
-        routes = settings.routes[method]
-        return unless routes
-
-        # Do some cleanup that matches Sinatra::Base#process_route
-        route = '/' if route.empty? && !settings.empty_path_info?
-        route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
-
-        # Find the route that matches this request. Since we're using
-        # settings, we should resolve in the same precedence as Sinatra
-        routes.each do |pattern, _, _| # Mustermann::Sinatra
-          next unless pattern.params(route)
-
-          dtm = Contrast::Utils::PathUtil.get_sinatra_route(cs__class, method, pattern)
-          context.append_route_coverage(dtm)
-          break
-        end
-      end
-    end
-  end
-end

data/lib/contrast/tasks/service.rb

@@ -1,95 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/os'
-
-module Contrast
-  # A Rake task designed to allow control of the Contrast Service as a stand
-  # alone executable rather than one managed by the Agent running in a process
-  # forked from the application
-  module Service
-    extend Rake::DSL
-    include Contrast::Components::Interface
-
-    access_component :contrast_service
-
-    # Start the service if it is not already running
-    def self.start_service
-      puts 'Starting Contrast Service'
-      service_log = CONTRAST_SERVICE.logger_path
-      if File.writable?(service_log)
-        spawn('contrast_service', out: File::NULL, err: service_log)
-      else
-        spawn('contrast_service', %i[out err] => File::NULL)
-      end
-
-      watcher = Contrast::Agent::Thread.new do
-        sleep(0.05) until Contrast::Utils::OS.running?
-      end
-      watcher.join(1)
-      puts Contrast::Utils::OS.running? ? 'Contrast Service started successfully.' : 'Contrast Service did not start.'
-    end
-
-    # Stop the service if it is running
-    def self.stop_service
-      if Contrast::Utils::OS.windows?
-        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
-        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
-        `Taskkill /PID #{ pid } /F` if pid
-      else
-        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
-        `kill #{ pid }` if pid
-      end
-    end
-
-    namespace :contrast do
-      namespace :service do
-        desc 'Starts the Contrast Service'
-        task :start do
-          if Contrast::Utils::OS.running?
-            puts 'Contrast Service already running. No need to start'
-          elsif !CONTRAST_SERVICE.enabled?
-            puts 'Contrast Service disabled by configuration. Not starting.'
-          else
-            start_service
-          end
-        end
-      end
-    end
-
-    namespace :contrast do
-      namespace :service do
-        desc 'Prints the status of the Contrast Service'
-        task :status do
-          if Contrast::Utils::OS.running?
-            puts 'online'
-          elsif CONTRAST_SERVICE.enabled?
-            puts 'offline'
-          else
-            puts 'disabled'
-          end
-        end
-      end
-    end
-
-    namespace :contrast do
-      namespace :service do
-        desc 'Stops the Contrast Service'
-        task :stop do
-          if Contrast::Utils::OS.running?
-            puts 'Stopping Contrast Service'
-            stop_service
-            watcher = Contrast::Agent::Thread.new do
-              sleep(0.05) while Contrast::Utils::OS.running?
-            end
-            watcher.join(1)
-            puts Contrast::Utils::OS.running? ? 'Contrast Service did not stop.' : 'Contrast Service stopped successfully.'
-          else
-            puts 'Contrast Service is not already running. No need to stop.'
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/boolean_util.rb

@@ -1,33 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-
-module Contrast
-  module Utils
-    # Utility methods for asserting truthy or falsy state of a value expected
-    # to equate to a boolean
-    class BooleanUtil
-      class << self
-        # Ruby 2.4 does not nicely compare to nil, so we have to include
-        # these wrapper methods. RUBY-179 has the task to update this on
-        # EOL of 2.4 support
-        def false? config
-          return false unless config
-          return false if config == true
-          return true if config == false
-
-          Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
-        end
-
-        def true? config
-          return false unless config
-          return false if config == false
-          return true if config == true
-
-          Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/cache.rb

@@ -1,69 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Implementation taken from http://stackoverflow.com/questions/1933866/efficient-ruby-lru-cache
-    class Cache
-      def initialize max_size = 1000
-        @max_size = max_size
-        @data = {}
-      end
-
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
-      def [] key
-        found = true
-        value = @data.delete(key) { found = false }
-        @data[key] = value if found
-      end
-
-      def []= key, value
-        @data.delete(key)
-        @data[key] = value
-        @data.delete(@data.first[0]) if @data.length > @max_size
-
-        value # rubocop:disable Lint/Void
-      end
-
-      def each
-        @data.reverse_each do |pair|
-          yield pair
-        end
-      end
-
-      # used further up the chain, non thread safe each
-      alias_method :each_unsafe, :each
-
-      def to_a
-        @data.to_a.reverse
-      end
-
-      def delete key
-        @data.delete(key)
-      end
-
-      def clear
-        @data.clear
-      end
-
-      def count
-        @data.count
-      end
-
-      # for cache validation only, ensures all is sound
-      def valid?
-        true
-      end
-    end
-  end
-end

data/lib/contrast/utils/comment_range.rb

@@ -1,19 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Stores the range of a comment
-    class CommentRange
-      COMMENT_START = /<!--/.cs__freeze
-      COMMENT_END = '-->'
-
-      attr_reader :open, :close
-
-      def initialize open_idx, close_idx
-        @open = open_idx
-        @close = close_idx
-      end
-    end
-  end
-end

data/lib/contrast/utils/data_store_util.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility class used to determine information about the current data store
-    # on which a query was executed or to which the application is connected.
-    module DataStoreUtil
-      def self.report_data_store data_store
-        return unless data_store
-
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context&.activity
-
-        context.activity.technologies[data_store] = true
-        context.activity.query_count += 1
-        return unless context.activity.query_count == 1
-
-        Contrast::Utils::InventoryUtil.append_db_config(context.activity)
-      end
-    end
-  end
-end

data/lib/contrast/utils/environment_util.rb

@@ -1,152 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'socket'
-cs__scoped_require 'contrast/core_extensions/module'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-
-module Contrast
-  module Utils
-    # Gather information about the application and server environment
-    # that the agent is running in.
-    class EnvironmentUtil
-      include Contrast::Components::Interface
-
-      access_component :analysis
-
-      DEFAULT_APP_NAME = 'rack'
-      DEFAULT_SERVER_NAME = 'localhost'
-
-      CS_VERSION = 'VERSION'
-
-      # Possible names of constants that would hold version info
-      VERSION_CONSTANT_CANDIDATES = %w[
-        VERSION
-        ::VERSION
-        Version::VERSION
-        ::Version::VERSION
-        ::Application::VERSION
-      ].cs__freeze
-
-      # Common places where view-layer files can be found in a Rails application
-      RAILS_VIEWS = [
-        ['app/assets', '*.coffee', %w[CoffeeScript]],
-        ['app/assets', '*.scss', %w[SASS]],
-        ['app/views', '*.html', %w[HTML5]],
-        ['app/views', '*.html.erb', %w[HTML5 ERB]],
-        ['app/views', '*.html.haml', %w[HTML5 HAML]],
-        ['public', '*.html', %w[HTML5]]
-      ].cs__freeze
-
-      class << self
-        ######### These are helpers ####################
-
-        def present? str
-          !str.nil? && !str.to_s.empty?
-        end
-
-        ######### Actually env/framework dependent ####################
-
-        # See CONTRAST-16380 for more details
-        def determine_application_version
-          @_determine_application_version ||= begin
-            candidates = VERSION_CONSTANT_CANDIDATES.map do |name|
-              # If there's a constant named 'name' (VERSION, etc.), get its value.
-              begin
-                name.split('::').inject(Object) do |mod, class_name|
-                  mod.cs__const_get(class_name)
-                end
-              rescue LoadError, StandardError
-                nil
-              end
-            end
-            candidates.compact!
-            candidate = candidates.first || ENV[CS_VERSION]
-
-            case candidate
-            when Hash
-              candidate.values.join(Contrast::Utils::ObjectShare::PERIOD)
-            when Array
-              candidate.join(Contrast::Utils::ObjectShare::PERIOD)
-            when String
-              candidate
-            when NilClass
-              return nil
-            else
-              candidate.inspect
-            end
-          end
-        end
-
-        def platform
-          version = Rails.version rescue Sinatra::VERSION rescue Rack.version rescue '' # rubocop:disable Style/RescueModifier
-          major, minor, patch = *version.split(Contrast::Utils::ObjectShare::PERIOD)
-          major ||= ''
-          minor ||= ''
-          patch ||= ''
-
-          [major, minor, patch]
-        rescue StandardError
-          Contrast::Utils::ObjectShare::EMPTY_TRIPLE
-        end
-
-        # Read libraries from the gemfile and append to the given ApplicationUpdate message
-        # or other class that has a libraries map association
-        def add_library_to_app_update app_update_pb, library_tags = ''
-          libraries = Contrast::Utils::GemfileReader.instance.library_pb_list
-          libraries.each do |n|
-            n.tags = library_tags
-            app_update_pb.libraries[n.hash_code] = n
-          end
-        end
-
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views app_update_msg
-          return unless INVENTORY.enabled?
-
-          scan_rails_views(app_update_msg)
-          scan_sinatra_views(app_update_msg)
-        end
-
-        # Find all the predefined routes for this application and append them to the
-        # provided inventory message
-        # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
-        # that has a routes array consisting of Contrast::Api::Dtm::RouteCoverage
-        def scan_routes msg
-          return unless INVENTORY.enabled?
-
-          Contrast::Utils::PathUtil.find_routes.each do |route|
-            msg.routes << route
-          end
-        end
-
-        private
-
-        def scan_view_directories app_update_msg, view_location_data
-          view_location_data.each do |path, extension, tech_names|
-            next if Dir["#{ path }/**/*#{ extension }"].empty?
-
-            tech_names.each do |tech|
-              app_update_msg.technologies[tech] = true
-            end
-          end
-        end
-
-        def scan_rails_views app_update_msg
-          scan_view_directories(app_update_msg, RAILS_VIEWS)
-        end
-
-        def scan_sinatra_views app_update_msg
-          sinatra_app = Contrast::Utils::SinatraHelper.app_class
-          return unless sinatra_app
-
-          scan_view_directories(app_update_msg, Contrast::Utils::SinatraHelper.scannable_view_dirs)
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/freeze_util.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/core_extensions/object'
-cs__scoped_require 'contrast/utils/duck_utils'
-
-module Contrast
-  module Utils
-    # This utility allows us to act on frozen objects, creating an unfrozen
-    # duplicate in those cases where that is possible.
-    class FreezeUtil
-      class << self
-        # Make every attempt to duplicate the frozen object so that it can
-        # be tracked. Some things, like Nil, True, and False, respond to dup
-        # but throw a TypeError. This catches that case and returns the
-        # original. We luck out as these three cases do not get propagated to
-        #
-        # @param original [Object] something frozen, usually a String
-        # @return [Object] the original or an unfrozen copy
-        def unfreeze_dup original
-          return original unless original.cs__frozen?
-          return original unless Contrast::Utils::DuckUtils.quacks_like_duplicable?(original)
-
-          copy = original.dup
-          if Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(copy)
-            copy.each_key do |key|
-              value = original[key]
-              copy[key] = Contrast::Utils::DuckUtils.quacks_like_duplicable?(original) ? value.dup : value
-            end
-          end
-          copy
-        end
-      end
-    end
-  end
-end