contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/components/config.rb

@@ -23,8 +23,7 @@ module Contrast
     # it should break LOUDLY.  Better to waste half an hour of the sysadmin's
     # time than to silently fail to deliver functionality.
     module Config
-      LOG_CONFIGURATION_DISABLED = 'Contrast disabled by configuration. Continuing without instrumentation.'
-      CONTRAST_ENV_MARKER        = 'CONTRAST__'
+      CONTRAST_ENV_MARKER = 'CONTRAST__'
 
       class Interface # :nodoc:
         def initialize
@@ -51,7 +50,8 @@ module Contrast
         end
 
         def enabled?
-          Contrast::Utils::BooleanUtil.true?(raw.enable)
+          @_enabled = !Contrast::Utils::BooleanUtil.false?(raw.enable) if @_enabled.nil?
+          @_enabled
         end
 
         def disabled?
@@ -59,11 +59,13 @@ module Contrast
         end
 
         def protect?
-          Contrast::Utils::BooleanUtil.true?(raw.protect.enable)
+          @_protect = Contrast::Utils::BooleanUtil.true?(raw.protect.enable) if @_protect.nil?
+          @_protect
         end
 
         def assess?
-          Contrast::Utils::BooleanUtil.true?(raw.assess.enable)
+          @_assess = Contrast::Utils::BooleanUtil.true?(raw.assess.enable) if @_assess.nil?
+          @_assess
         end
 
         def session_id

data/lib/contrast/components/contrast_service.rb

@@ -25,10 +25,6 @@ module Contrast
           state.service_enabled?
         end
 
-        def unavailable?
-          !enabled?
-        end
-
         def disabled?
           state.service_forcibly_disabled?
         end

data/lib/contrast/components/heap_dump.rb

@@ -16,17 +16,21 @@ module Contrast
         access_component :config
 
         def heap_dump_enabled?
-          state.heap_dump_enabled?
+          heap_dump_control[:enabled]
         end
 
         def heap_dump_control
-          {
-              path: File.absolute_path(CONFIG.root.agent.heap_dump.path),
-              count: CONFIG.root.agent.heap_dump.count.to_i,
-              window: CONFIG.root.agent.heap_dump.window_ms.to_f / 1000,
-              delay: CONFIG.root.agent.heap_dump.delay_ms.to_f / 1000,
-              clean: true?(CONFIG.root.agent.heap_dump.clean)
-          }
+          @_heap_dump_control ||= begin
+            config = CONFIG.root&.agent&.heap_dump
+            {
+                enabled: true?(config&.enable),
+                path: File.absolute_path(config&.path),
+                count: config&.count.to_i || 0,
+                window: (config&.window_ms.to_f || 0) / 1000,
+                delay: (config&.delay_ms.to_f || 0) / 1000,
+                clean: true?(config&.clean)
+            }
+          end
         end
       end
     end

data/lib/contrast/components/interface.rb

@@ -97,7 +97,7 @@ module Contrast
       #
       # class Abc
       #   include Contrast::Components::Interface
-      #   access_component :logger, :agent
+      #   access_component :logging, :agent
       #
       #   def function
       #     if AGENT.disabled?
@@ -151,6 +151,16 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:config] =
 cs__scoped_require 'contrast/components/settings'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:settings] = [Contrast::Components::Settings]
 
+cs__scoped_require 'contrast/components/assess'
+cs__scoped_require 'contrast/components/protect'
+cs__scoped_require 'contrast/components/inventory'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [Contrast::Components::Protect,
+                                                                                   Contrast::Components::Assess,
+                                                                                   Contrast::Components::Inventory]
+
+cs__scoped_require 'contrast/components/logger'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] = [Contrast::Components::Logger]
+
 cs__scoped_require 'contrast/components/agent'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
 
@@ -163,15 +173,6 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_s
 cs__scoped_require 'contrast/components/heap_dump'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:heap_dump] = [Contrast::Components::HeapDump]
 
-cs__scoped_require 'contrast/components/logger'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] = [Contrast::Components::Logger]
-
-cs__scoped_require 'contrast/components/assess'
-cs__scoped_require 'contrast/components/protect'
-cs__scoped_require 'contrast/components/inventory'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [Contrast::Components::Protect,
-                                                                                   Contrast::Components::Assess,
-                                                                                   Contrast::Components::Inventory]
 cs__scoped_require 'contrast/components/sampling'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:sampling] = [Contrast::Components::Sampling]
 

data/lib/contrast/components/logger.rb

@@ -1,12 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/logger'
+
 module Contrast
   module Components
     module Logger
       module InstanceMethods #:nodoc:
         def logger
-          Contrast::Components::Logger::COMPONENT_INTERFACE
+          Contrast::Agent::Logger.instance.logger
         end
       end
       ClassMethods = InstanceMethods
@@ -17,73 +19,6 @@ module Contrast
       # Specifically, this allows for querying the state of the Agent Logger.
       class Interface
         include Contrast::Components::ComponentBase
-
-        %w[error? warn? info? debug?].each do |level|
-          define_method(level) { state.logger.send(level) }
-        end
-
-        # def trace? # TODO: RUBY-547
-        #  config&.agent&.logger&.level && config.agent.logger.level.to_s.casecmp('TRACE').to_i.zero?
-        # end
-
-        def error *args
-          log_with_level(*args, :error)
-        end
-
-        def warn *args
-          log_with_level(*args, :warn)
-        end
-
-        def info *args
-          log_with_level(*args, :info)
-        end
-
-        def debug *args
-          log_with_level(*args, :debug)
-        end
-
-        def with_level *args
-          log_with_level(*args)
-        end
-
-        def debug_with_time msg
-          ret = nil
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        # def trace_with_time msg # TODO: RUBY-547
-        #  ret = nil
-        #  unless trace?
-        #    ret = yield if block_given?
-        #    return ret
-        #  end
-        #
-        #  a = Contrast::Utils::Timer.now_ms
-        #  ret = yield if block_given?
-        #  z = Contrast::Utils::Timer.now_ms
-        #  log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-        #  ret
-        # end
-
-        private
-
-        def log_with_level *args
-          if args.length == 2
-            msg, level = *args
-            state.cs__class.log_with_level(nil, msg, level)
-          elsif args.length == 3
-            exception, msg, level = *args
-            state.cs__class.log_with_level(exception, msg, level)
-          end
-
-          nil
-        rescue StandardError
-          nil
-        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/sampling.rb

@@ -9,7 +9,7 @@ module Contrast
         DEFAULT_SAMPLING_BASELINE           = 5
         DEFAULT_SAMPLING_REQUEST_FREQUENCY  = 5
         DEFAULT_SAMPLING_RESPONSE_FREQUENCY = 25
-        DEFAULT_SAMPLING_WINDOW_MS          = 180_000 # 3 minutes, arbitrary value from Java agent
+        DEFAULT_SAMPLING_WINDOW_MS          = 180_000
       end
 
       module ClassMethods #:nodoc:
@@ -17,18 +17,29 @@ module Contrast
         include Constants
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :config, :settings
 
-        def sampling_control settings = @sampling_features
-          cas = CONFIG.root.assess&.sampling
+        def sampling_enabled?
+          sampling_control[:enabled]
+        end
+
+        def sampling_control
+          @_sampling_control ||= begin
+            cas = CONFIG.root.assess&.sampling
+            settings = SETTINGS&.assess_state&.[](:sampling_settings)
+            {
+                enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0]),
+                baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?),
+                request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?),
+                response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
+                window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+            }
+          end
+        end
 
-          {
-              enabled: [cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED] .reject(&:nil?).first,
-              baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE] .map(&:to_i).find(&:positive?),
-              request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY] .map(&:to_i).find(&:positive?),
-              response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-              window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS] .map(&:to_i).find(&:positive?)
-          }
+        # Used to reset sampling when settings from TeamServer change
+        def reset_sampling_control
+          @_sampling_control = nil
         end
       end
 

data/lib/contrast/components/settings.rb

@@ -59,7 +59,6 @@ module Contrast
         PROTECT_STATE_ATTRS       = %i[].cs__freeze
         ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
         APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
-        STATE_ATTRS               = PROTECT_STATE_ATTRS | ASSESS_STATE_ATTRS | APPLICATION_STATE_ATTRS
 
         # Meta-define an accessor for each state attribute.
         begin
@@ -86,6 +85,24 @@ module Contrast
           reset_state
         end
 
+        def update_from_server_features server_features
+          # protect
+          begin
+            protect_state[:enabled] = server_features.protect_enabled?
+          end
+
+          # assess
+          begin
+            assess_state[:enabled] = server_features.assess_enabled?
+            assess_state[:sampling_settings] = server_features.assess.sampling
+            Contrast::Utils::Assess::SamplingUtil.instance.update
+          end
+        end
+
+        def update_from_application_settings application_settings
+          application_state.merge!(application_settings.application_state_translation)
+        end
+
         # Wipe state to zero.
         def reset_state
           @assess_rules = {}
@@ -123,10 +140,6 @@ module Contrast
           Contrast::Agent::Protect::Rule::Csrf.new
         end
 
-        def protect_rule name
-          @protect_rules[name]
-        end
-
         # these are less 'settings' and more 'how do I behave.'
         # relocate to Agent or Assess/Protect.
         def protect_rule_mode rule_id

data/lib/contrast/config/base_configuration.rb

@@ -15,6 +15,7 @@ module Contrast
       BOOLEANS = [true, false].cs__freeze
 
       attr_reader :map
+
       alias_method :to_hash, :map
       def_delegators :@map, :empty?, :key?,
                      :delete,

data/lib/contrast/config/default_value.rb

@@ -8,6 +8,7 @@ module Contrast
     # explicitly to false.
     class DefaultValue
       attr_reader :value
+
       def initialize value
         @value = value
       end

data/lib/contrast/config/protect_rule_configuration.rb

@@ -8,12 +8,6 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # rule mode of a single protect rule in the Agent.
     class ProtectRuleConfiguration < BaseConfiguration
-      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
-      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-
       KEYS = {
           enable: EMPTY_VALUE,
           mode: EMPTY_VALUE,
@@ -24,14 +18,6 @@ module Contrast
       def initialize hsh
         super(hsh, KEYS)
       end
-
-      def off?
-        mode == 'off'
-      end
-
-      def on?
-        !off?
-      end
     end
   end
 end

data/lib/contrast/configuration.rb

@@ -63,11 +63,9 @@ module Contrast
     # in an infinite loop on the to_sym method used later.
     def method_missing symbol, *args
       with_contrast_scope do
-        begin
-          root.public_send(symbol, *args)
-        rescue NoMethodError => _e
-          super
-        end
+        root.public_send(symbol, *args)
+      rescue NoMethodError => _e
+        super
       end
     end
 

data/lib/contrast/extensions/framework/rails/action_controller_inheritance.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module ActionController
+  module Railties
+    # Used to monkey patch all the inherited calls in action_pack
+    #
+    # This is the usual entry point for Rails inheritance work, so it should
+    # catch most of the calls to inherited.
+    module Helpers
+      alias_method :cs__patched_inherited, :inherited
+      def inherited klass
+        klass&.instance_variable_set(:@cs__defining_class, true)
+        cs__patched_inherited(klass)
+      ensure
+        klass&.instance_variable_set(:@cs__defining_class, false)
+      end
+    end
+  end
+end
+
+module ActiveRecord
+  module AttributeMethods
+    # Used to monkey patch all the inherited calls in action_pack
+    module TimeZoneConversion
+      module ClassMethods #:nodoc:
+        private
+
+        alias_method :cs__patched_inherited, :inherited
+        def inherited klass
+          klass&.instance_variable_set(:@cs__defining_class, true)
+          cs__patched_inherited(klass)
+        ensure
+          klass&.instance_variable_set(:@cs__defining_class, false)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/extensions/framework/rails/active_record_named.rb

@@ -13,19 +13,14 @@ module ActiveRecord
       # TODO: RUBY-534
       module ClassMethods
         include Contrast::Components::Interface
-        access_component :logging, :agent
+        access_component :agent, :logging
 
         def _cs__rewrite method_name, body
           return body unless AGENT.rewrite_interpolation?
           return body unless body.is_a?(Proc)
 
           location = body.source_location
-          return body if location.nil?
-
-          # Good news, once we patch the body once, the source location
-          # becomes eval. We may need to fix this later though (so it may
-          # be bad news)
-          return body if location.empty? || location[0].empty? || location[0].include?('eval')
+          return body unless _cs__location_available?(location)
 
           opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(self))
           original_source_code = opener.source_code(location, method_name)
@@ -43,9 +38,19 @@ module ActiveRecord
 
           unbound_eval(cs__name, new_method_source)
         rescue SyntaxError, StandardError => e
-          logger.debug(e, "Can't parse method source in scoped method #{ method_name }: #{ e.message }")
+          logger.debug('Can\'t parse method source in scoped method', e, method: method_name)
           body
         end
+
+        # Good news, once we patch the body once, the source location
+        # becomes eval. We may need to fix this later though (so it may
+        # be bad news)
+        def _cs__location_available? location
+          return false if location.nil?
+          return false if location.empty? || location[0].empty? || location[0].include?('eval')
+
+          true
+        end
       end
     end
   end

data/lib/contrast/extensions/ruby_core/assess.rb

@@ -3,7 +3,7 @@
 
 module Contrast
   module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+    # Our top level Assess namespace in the Core Extensions section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
@@ -31,7 +31,6 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/agent/assess/frozen_properties'
       cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable