contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/utils/gemfile_reader.rb

@@ -1,191 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'set'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/api'
-
-module Contrast
-  module Utils
-    # GemfileReader has methods for extracting information from gem specs
-    # it also has a cache of library file digests to the lines of code found.
-    class GemfileReader
-      include Singleton
-      include Contrast::Components::Interface
-
-      access_component :logging
-
-      CONTRAST_AGENT = 'contrast-agent'
-
-      def initialize
-        # Map of a Gem's Spec Digest to all loaded files from that Gem
-        @spec_to_files = {}
-      end
-
-      # the #clone is necessary here, as a require in another thread could
-      # potentially result in adding a key to the loaded_specs hash during
-      # iteration.  (as in RUBY-330)
-      def loaded_specs
-        Gem.loaded_specs.clone
-      end
-
-      # indicates if there's been an update to library information, allowing us
-      # to only serialize this information on change.
-      def updated?
-        @updated
-      end
-
-      def updated!
-        @updated = true
-      end
-
-      # Once we're Contrasted, we intercept require calls to do inventory.
-      # In order to catch up, we do a one-time manual catchup, & inventory
-      # all the already-loaded gems.
-      def map_loaded_classes
-        loaded_specs.each do |name, spec|
-          # Don't count Contrast gems
-          next if contrast_gems.include? name
-
-          # Get a digest of the Gem file itself
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          paths = get_by_digest(digest)
-          path = spec.full_gem_path
-          $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
-
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
-            updated!
-            paths << adjust_lib(line)
-          end
-        end
-      end
-
-      def map_class path
-        path = adjust_lib(path)
-
-        return unless (spec   = Gem::Specification.find_by_path(path))
-        return unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-        updated!
-        get_by_digest(digest) << path
-      end
-
-      def library_pb_list
-        loaded_specs.each_with_object([]) do |(name, spec), arr|
-          next if contrast_gems.include? name
-          next unless spec
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          arr << build_library_pb(digest, spec)
-        end
-      end
-
-      def generate_library_usage activity = nil
-        return unless updated?
-
-        @spec_to_files.each_pair do |digest, files|
-          usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
-          usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
-          activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
-          #   send the class names in usage.class_names
-          usage.count = files.size
-        end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
-        #   @updated variable
-
-        # @spec_to_files.clear
-        @updated = false
-      end
-
-      private
-
-      # marker for the lib dir in an absolute file path. purposefully includes
-      # the trailing '/'
-      LIB = '/lib/'
-
-      # Kernel#load uses the absolute path, but Gems / Specs use the path after
-      # `/lib`. This method accounts for that and trims out the `/lib/` section
-      # and starts with the first `/` after and the trailing file extension, if
-      # present.
-      #
-      # @param path [String] the path to parse
-      # @return [String] the relative path of the file, after the lib directory
-      def adjust_lib path
-        idx = path.index(LIB)
-        path = path[(idx + 4)..-1] if idx
-        idx = path.rindex(Contrast::Utils::ObjectShare::PERIOD)
-        path = path[0..idx] if idx
-        path
-      end
-
-      def get_by_digest digest
-        @spec_to_files[digest] = Set.new unless @spec_to_files.key?(digest)
-        @spec_to_files[digest]
-      end
-
-      def build_library_pb digest, spec
-        lib             = Contrast::Api::Dtm::Library.new
-        lib.file_path   = Contrast::Utils::StringUtils.force_utf8(spec.name)
-        lib.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
-        lib.version     = Contrast::Utils::StringUtils.force_utf8(spec.version)
-        lib.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(spec))
-        lib.external_ms = date_to_ms(spec.date)
-        lib.internal_ms = lib.external_ms
-        lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
-        update_class_counts(lib, digest, spec)
-        lib
-      end
-
-      def date_to_ms date
-        (date.to_f * 1000.0).to_i
-      end
-
-      def update_class_counts lib, digest, spec
-        # Updating the class counts
-        path = spec.full_gem_path.to_s
-        lib.class_count = all_files(path).length
-        lib.used_class_count = @spec_to_files.key?(digest) ? get_by_digest(digest).size : 0
-        lib
-      end
-
-      def build_manifest spec
-        Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s) if defined?(YAML)
-      rescue StandardError
-        nil
-      end
-
-      # These are all the code files that are located in the Gem directory loaded
-      # by the current environment; this includes more than Ruby files
-      def all_files path
-        Contrast::Utils::Sha256Builder.instance.files(path)
-      end
-
-      # Go through all dependents, given as a pair from the DependencyList: `dependency`
-      # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
-      # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
-      # then contrast depends on it. If its array of dependents is 1, then contrast is the
-      # only dependency in that list. Since only contrast depends on it, we should ignore it.
-      def contrast_gems
-        @_contrast_gems ||= find_contrast_gems
-      end
-
-      def find_contrast_gems
-        ignore = Set.new([CONTRAST_AGENT])
-        contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
-          dependency.name == CONTRAST_AGENT
-        end
-        contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
-
-        Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
-          ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
-        end
-        ignore
-      end
-    end
-  end
-end

data/lib/contrast/utils/inventory_util.rb

@@ -1,126 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # Utilities for getting inventory information from the application
-    class InventoryUtil
-      include Contrast::Components::Interface
-      access_component :logging
-
-      # TeamServer only accepts certain values for ArchitectureComponents.
-      # DO NOT CHANGE THIS!
-      AC_TYPE_DB = 'db'
-      # TeamServer only accepts certain values for FlowMap Services.
-      # DO NOT CHANGE THIS
-      DATABASE = 'Database'
-      ADAPTER = 'adapter'
-      HOST = 'host'
-      PORT = 'port'
-      DATABASE_LOWER = 'database'
-      DEFAULT = 'default'
-      LOCALHOST = 'localhost'
-
-      def self.inventory_class class_path
-        Contrast::Utils::GemfileReader.instance.map_class(class_path)
-      rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
-      end
-
-      def self.active_record_config
-        return @_active_record_config if instance_variable_defined?(:@_active_record_config)
-
-        @_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
-      end
-
-      def self.append_db_config activity_or_update, hash_or_str = Contrast::Utils::InventoryUtil.active_record_config
-        arr = build_from_db_config(hash_or_str)
-        return unless arr&.any?
-
-        activity_or_update.technologies[DATABASE] = true
-        arr.each do |a|
-          next unless a
-
-          if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
-            activity_or_update.architectures << a
-          else
-            activity_or_update.components << a
-          end
-          next if a.vendor.empty?
-
-          activity_or_update.technologies[a.vendor] = true
-        end
-      rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
-        nil
-      end
-
-      def self.build_from_db_config hash_or_str
-        return unless hash_or_str
-
-        if hash_or_str.is_a?(Hash)
-          build_from_db_hash(hash_or_str)
-        else
-          build_from_db_string(hash_or_str.to_s)
-        end
-      end
-
-      def self.build_from_db_hash hash
-        ac = Contrast::Api::Dtm::ArchitectureComponent.new
-        ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
-        ac.remote_host = host_from_hash(hash)
-        ac.remote_port = port_from_hash(hash)
-        ac.type = AC_TYPE_DB
-        ac.url = hash[:database] || hash[DATABASE_LOWER] || DEFAULT
-        [ac]
-      end
-
-      def self.host_from_hash hash
-        hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
-
-      def self.port_from_hash hash
-        p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
-        p.to_i
-      end
-
-      # Examples:
-      # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
-      # postgresql://scott:tiger@localhost/mydatabase
-      # mysql+mysqlconnector://scott:tiger@localhost/foo
-      def self.build_from_db_string str
-        adapter, hosts, database = split_connection_str(str)
-        acs = []
-        hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
-          host, port = s.split(Contrast::Utils::ObjectShare::COLON)
-
-          ac = Contrast::Api::Dtm::ArchitectureComponent.new
-          ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
-          ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
-          ac.remote_port = port.to_i
-          ac.type = AC_TYPE_DB
-          ac.url = Contrast::Utils::StringUtils.force_utf8(database)
-          acs << ac
-        end
-        acs
-      end
-
-      def self.split_connection_str str
-        adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
-        _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
-        # Not currently used
-        # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
-        hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
-        hosts << LOCALHOST if hosts.empty?
-        database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
-
-        [adapter, hosts, database]
-      end
-    end
-  end
-end

data/lib/contrast/utils/operating_environment.rb

@@ -1,38 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # A utility class to detect the environment the agent is operating within
-    class OperatingEnvironment
-      include Contrast::Components::Interface
-      access_component :logging
-
-      def self.unsupported?
-        sidekiq? || rake?
-      end
-
-      def self.sidekiq?
-        return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
-
-        logger.debug(nil, "Detected the spawn of a Sidekiq process. Disabling Contrast for process #{ Process.pid }")
-        true
-      end
-
-      def self.rake?
-        return unless defined?(Rake) &&
-            Rake.cs__respond_to?(:application) &&
-            Rake.application.cs__respond_to?(:top_level_tasks)
-
-        disabled_rake_tasks = Contrast::Agent::FeatureState.instance.disabled_agent_rake_tasks
-        disabled_task = Rake.application.top_level_tasks.any? { |task| disabled_rake_tasks.include?(task) }
-        return false unless disabled_task
-
-        logger.debug(nil, "Detected startup within the rake task #{ disabled_task }. Disabling Contrast for process #{ Process.pid }")
-        true
-      end
-    end
-  end
-end

data/lib/contrast/utils/path_util.rb

@@ -1,151 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/class_util'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # Utility methods for finding routes within frameworks
-    class PathUtil
-      include Contrast::Components::Interface
-      access_component :logging
-
-      COVERAGE_LIMIT = 500 # CONTRAST-25730: Arbitrary coverage limit imposed by TeamServer
-
-      class << self
-        # find the routes in the application. since each framework maintains the
-        # routes slightly differently, we'll only support those that we've explicitly
-        # implemented (Rails & Sinatra currently)
-        #
-        # this method always returns an array, even if it's empty
-        def find_routes
-          if defined?(Rails)
-            find_rails_routes
-          elsif defined?(Sinatra)
-            find_sinatra_routes
-          else
-            Contrast::Utils::ObjectShare::EMPTY_ARRAY
-          end
-        rescue StandardError
-          Contrast::Utils::ObjectShare::EMPTY_ARRAY
-        end
-
-        # Given the Contrast Request object, determine the current Coverage route,
-        # returning a RouteCoverage object
-        def get_route request
-          get_rails_route(request) if defined?(Rails)
-        rescue StandardError => e
-          logger.error(e, 'Unable to generate route from request')
-          nil
-        end
-
-        def find_rails_routes
-          routes = []
-          count = 0
-          Rails.application.routes.routes.each do |route|
-            routes << rails_route_to_coverage(route)
-            count += 1
-            return routes if count > COVERAGE_LIMIT
-          end
-          routes
-        end
-
-        def get_rails_route request
-          return unless Rails.cs__respond_to?(:application)
-
-          # returns array of arrays [[match_data, path_parameters, route]], sorted by
-          # precedence
-          # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
-          # path_parameters: hash of various things
-          # route: ActionDispatch::Journey::Route
-          full_routes = Rails.application.routes.router.send(:find_routes, request.rack_request)
-          return if full_routes.empty?
-
-          full_route = full_routes[0] # [match_data, path_parameters, route]
-          return unless full_route
-
-          route = full_route[2]       # route w/ highest precedence
-          return unless route
-
-          rails_route_to_coverage(route)
-        end
-
-        # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-        def rails_route_to_coverage route
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
-
-          verb = source_or_string(route.verb)
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
-
-          url = source_or_string(route.path.spec)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
-          route_coverage
-        end
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        # Iterate over every class that extends Sinatra::Base, pull out its routes
-        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-        # Contrast::Api::Dtm::RouteCoverage
-        def find_sinatra_routes
-          routes = []
-          controllers = sinatra_controllers
-          controllers.each do |clazz|
-            class_routes = sinatra_class_routes(clazz)
-            next unless class_routes
-
-            class_routes.each_pair do |method, list|
-              # item: [ Mustermann::Sinatra, [], Proc]
-              list.each do |item|
-                routes << sinatra_route_to_coverage(clazz, method, item[0])
-                return routes if routes.length > COVERAGE_LIMIT
-              end
-            end
-          end
-          routes
-        end
-
-        def sinatra_controllers
-          return [] unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-          Contrast::Utils::ClassUtil.ancestors_of(Sinatra::Base)
-        end
-
-        def sinatra_class_routes controller
-          controller.instance_variable_get(:@routes)
-        rescue StandardError
-          logger.debug(nil, "#{ clazz } has no routes instance")
-          nil
-        end
-
-        # Invoked directly on Sinatra::Base#call!
-        def get_sinatra_route clazz, method, pattern
-          sinatra_route_to_coverage(clazz, method, pattern)
-        end
-
-        # given clazz, method, and Mustermann::Sinatra, build a
-        # Contrast::Api::Dtm::RouteCoverage
-        def sinatra_route_to_coverage clazz, method, pattern
-          safe_pattern = source_or_string(pattern)
-
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
-          route_coverage
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/performs_logging.rb

@@ -1,152 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This utility allows us wrap our calls to logging, allowing runtime
-    # determination as to whether or not an event should be logged, based upon
-    # the Logging Configuration as specified in Common Configuration.
-    module PerformsLogging
-      include Contrast::Components::Interface
-
-      COULDNT_INIT_CONFIG = '!!! Contrast could not initialize agent from config, flushing loq queue to TARGET !!!'
-      FLUSHING_LOG_QUEUE  = '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-
-      TARGET = STDOUT
-
-      # idiom for propagating class methods
-      def self.included base
-        base.send :include, InstanceMethods
-        base.extend ClassMethods
-      end
-
-      # Grouping to allow for these methods to be included into another Module
-      # on include of the PerformsLogging Module. They'll function as instance
-      # methods in that Module.
-      module InstanceMethods #:nodoc:
-        @_log_mutex = Mutex.new
-        @_log_queue = []
-
-        protected
-
-        def init_log_queueing
-          # Queue log messages & defer logging until logger gets initialized.
-          # (Logger depends on config, so logging config errors implies
-          # circular dependencies.)
-          at_exit do
-            # Ideally we flush the queue when we detect agent init is impossible,
-            # if worse comes to worse we do it here.
-            if @_log_queue
-              lq = @_log_queue
-              if lq&.any?
-                TARGET.puts '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-                while (message = lq.pop)
-                  TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-                end
-              end
-            end
-          end
-        end
-
-        def abort_log_queues
-          TARGET.puts COULDNT_INIT_CONFIG
-          if @_log_queue
-            TARGET.puts FLUSHING_LOG_QUEUE
-            while (message = @_log_queue.pop)
-              TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-            end
-          end
-          @_log_queue = nil
-          @_log_mutex = nil
-        end
-
-        def flush_log_queues
-          return unless @_log_queue
-
-          # Monkeypatch this class so that the next call to #instance flushes the log queue.
-          # (Flushing the log queue within #initialize
-          # causes a deadlock, as singleton classes' #initialize
-          # gets wrapped within a mutex, and our logger will
-          # try to reference the singleton instance.)
-          self.class.class_eval do
-            class << self
-              alias_method :__instance_original, :instance
-              def instance
-                @_log_mutex.synchronize do
-                  # Restore old #instance method.
-                  class_eval do
-                    class << self
-                      def instance
-                        __instance_original
-                      end
-                    end
-                  end
-                  # Flush log queue.
-                  if @_log_queue
-                    while (message = @_log_queue.pop)
-                      log_with_level(*message, skip_queue: true)
-                    end
-                  end
-                  @_log_queue = nil
-                end
-                @_log_mutex = nil
-                __instance_original
-              end
-            end
-          end
-        end
-      end
-
-      module ClassMethods #:nodoc:
-        def log_error msg, exception = nil
-          log_with_level exception, msg, :error
-        end
-
-        def log_warn msg, exception = nil
-          log_with_level exception, msg, :warn
-        end
-
-        def log_info msg, exception = nil
-          log_with_level exception, msg, :info
-        end
-
-        def log_debug msg, exception = nil
-          log_with_level exception, msg, :debug
-        end
-
-        def debug_with_time msg
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        def log_with_level exception, msg, level, skip_queue: false
-          # Log messages are queued until the logger is initialized.
-          # If agent init fails, flush the log to TARGET.
-          if (lq = @_log_queue) && !skip_queue
-            lq.push [exception, msg, level]
-            return nil
-          end
-
-          if exception&.respond_to?(:message)
-            tmp = msg.nil? ? exception.message.to_s : "#{ exception.class.name }: #{ msg }: #{ exception.message }"
-            logger.send(level, tmp)
-
-            exception.backtrace.first(10).each { |line| logger.debug(line) } if logger.debug? && exception.cs__respond_to?(:backtrace) && exception.backtrace
-          elsif msg.to_s != Contrast::Utils::ObjectShare::EMPTY_STRING
-            logger.send(level, msg.to_s)
-          end
-
-          nil # ensure no return value
-        rescue StandardError
-          nil # NOOP
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/preflight_util.rb

@@ -1,13 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility for generating preflight message token
-    class PreflightUtil
-      def self.create_preflight finding
-        "#{ finding.rule_id },#{ finding.hash_code }"
-      end
-    end
-  end
-end