contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/extensions/ruby_core/protect/rule_applicator.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/data_store_util'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is the base of our Protect Applicators. It lays out the
+      # form of the Applicator, which will override specific implementations
+      # in order to properly invoke its Rule.
+      module RuleApplicator
+        include Contrast::Components::Interface
+
+        access_component :analysis, :logging
+
+        def apply_rule method, exception, properties, object, args
+          invoke(method, exception, properties, object, args)
+        rescue Contrast::SecurityException => e
+          raise e
+        rescue StandardError => e
+          logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method, rule: name)
+        end
+
+        protected
+
+        def invoke _method, _exception, _properties, _object, _args
+          raise NotImplementedError, 'This is abstract, override it.'
+        end
+
+        def name
+          raise NotImplementedError, 'This is abstract, override it.'
+        end
+
+        def rule
+          PROTECT.rule name
+        end
+
+        def skip_analysis?
+          context = Contrast::Agent::REQUEST_TRACKER.current
+          return true unless context&.app_loaded?
+          return true unless rule&.enabled?
+
+          false
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/base_support.rb

@@ -42,6 +42,16 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
+        def retrieve_request _env
+          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
+        end
+
+        # We only support websockets in rails right now, so we won't detect streaming in
+        # any other framework
+        def streaming? _env
+          false
+        end
+
         protected
 
         def source_or_string obj

data/lib/contrast/framework/manager.rb

@@ -14,7 +14,7 @@ module Contrast
     # Allows access to framework specific information
     class Manager
       include Contrast::Components::Interface
-      access_component :logging, :analysis
+      access_component :analysis, :logging
 
       # Order here does matter as the first framework listed will be the first one we pull information from
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
@@ -28,7 +28,7 @@ module Contrast
         @_frameworks = SUPPORTED_FRAMEWORKS.map do |framework_klass|
           next unless enable_framework_support?(framework_klass.detection_class)
 
-          logger.debug("Detected framework #{ framework_klass.detection_class } - enabling support")
+          logger.info('Framework detected. Enabling support.', framework: framework_klass.detection_class)
           framework_klass
         end
         @_frameworks.compact!
@@ -56,6 +56,32 @@ module Contrast
         first_framework_result :application_name, 'root'
       end
 
+      def app_root
+        found = first_framework_result :application_root, nil
+        found || Rack::Directory.new('').root
+      end
+
+      # If we have 0 or n > 1 frameworks, we need to use the default rack request
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
+      #   and values of this particular Request
+      def retrieve_request env
+        return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
+
+        Rack::Request.new(env)
+      end
+
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state
+      #   and values of this particular Request
+      # @return [Boolean] true if at least one framework is streaming the response; false if none are streaming
+      def streaming? env
+        result = false
+        @_frameworks.each do |framework|
+          result = framework.streaming?(env)
+          break if result
+        end
+        result
+      end
+
       def get_route_dtm request
         result = nil
         @_frameworks.find do |framework_klass|

data/lib/contrast/framework/platform_version.rb

@@ -6,6 +6,7 @@ module Contrast
     # Used to map version strings from frameworks to ApplicationUpdate dtm
     class PlatformVersion
       attr_reader :major, :minor, :patch
+
       def initialize major, minor, patch
         @major = major || ''
         @minor = minor || ''

data/lib/contrast/framework/rails_support.rb

@@ -33,6 +33,10 @@ module Contrast
           Rails.application.cs__class.parent_name
         end
 
+        def application_root
+          Rails.root
+        end
+
         def server_type
           'rails'
         end
@@ -68,6 +72,18 @@ module Contrast
           route_to_coverage(route)
         end
 
+        def retrieve_request env
+          rails_env = Rails.application.env_config.merge(env)
+          ActionDispatch::Request.new(rails_env || env)
+        end
+
+        AC_INSTANCE = 'action_controller.instance'
+        def streaming? env
+          return false unless defined?(ActionController::Live)
+
+          env[AC_INSTANCE].cs__class.included_modules.include?(ActionController::Live)
+        end
+
         private
 
         # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage

data/lib/contrast/framework/sinatra_support.rb

@@ -23,6 +23,12 @@ module Contrast
           app_class.cs__class.cs__name
         end
 
+        def application_root
+          return unless app_class
+
+          app_class.root
+        end
+
         def server_type
           'sinatra'
         end
@@ -58,6 +64,10 @@ module Contrast
           nil
         end
 
+        def retrieve_request env
+          Sinatra::Request.new(env)
+        end
+
         private
 
         # Iterate over every class that extends Sinatra::Base, pull out its routes
@@ -70,9 +80,9 @@ module Contrast
         end
 
         def sinatra_class_routes controller
-          controller.instance_variable_get(:@routes)
+          controller.instance_variable_get(:@routes) if controller.instance_variable_defined?(:@routes)
         rescue StandardError
-          logger.debug(nil, "#{ controller } has no route instances")
+          logger.trace('Sinatra controller found with no route instances', module: controller)
           nil
         end
 

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -6,6 +6,7 @@ module Contrast
     # Used to define common locations and extensions for specific technologies
     class ViewTechnologiesDescriptor
       attr_reader :path, :extension, :technology_names
+
       def initialize path, extension, technology_names
         @path = path
         @extension = extension

data/lib/contrast/tasks/service.rb

@@ -33,14 +33,8 @@ module Contrast
 
     # Stop the service if it is running
     def self.stop_service
-      if Contrast::Utils::OS.windows?
-        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
-        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
-        `Taskkill /PID #{ pid } /F` if pid
-      else
-        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
-        `kill #{ pid }` if pid
-      end
+      pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
+      `kill #{ pid }` if pid
     end
 
     namespace :contrast do

data/lib/contrast/utils/assess/sampling_util.rb

@@ -19,7 +19,8 @@ module Contrast
         end
 
         def update
-          @enabled            = self.class.sampling_control[:enabled]
+          self.class.reset_sampling_control
+          @enabled            = self.class.sampling_enabled?
           @baseline           = self.class.sampling_control[:baseline]
           @request_frequency  = self.class.sampling_control[:request_frequency]
           @response_frequency = self.class.sampling_control[:response_frequency]
@@ -28,10 +29,6 @@ module Contrast
           true
         end
 
-        def reset
-          @requests.clear
-        end
-
         def sample? request
           history = request_history(request)
           history.hit
@@ -64,20 +61,18 @@ module Contrast
 
         # RequestHistory tracks one requests history per time window
         class RequestHistory
-          attr_accessor :window_start, :total_hit, :window_hit
+          attr_reader :window_start, :window_hit
 
           def initialize
             @window_start = Contrast::Utils::Timer.now_ms
-            @total_hit = 0
             @window_hit = 0
           end
 
           def elapsed
-            Contrast::Utils::Timer.now_ms - @window_start
+            Contrast::Utils::Timer.now_ms - window_start
           end
 
           def hit cnt = 1
-            @total_hit += cnt
             @window_hit += cnt
           end
 

data/lib/contrast/utils/assess/tracking_util.rb

@@ -1,11 +1,17 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     module Assess
       # TrackingUtil has methods for determining if a object is being tracked
       class TrackingUtil
+        include Contrast::Components::Interface
+
+        access_component :logging
+
         def self.tracked? obj
           return false if obj.nil?
 
@@ -28,7 +34,7 @@ module Contrast
           # This is used to ask if a ton of objects are tracked. They may not
           # all be iterable. Bad things could happen in some cases, like when
           # checking a closed statement for SQL injection trigger events
-          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
+          logger.warn('Failed to determine tracking', e, module: obj.cs__class)
           false
         end
       end

data/lib/contrast/utils/boolean_util.rb

@@ -9,21 +9,18 @@ module Contrast
     # to equate to a boolean
     class BooleanUtil
       class << self
-        # Ruby 2.4 does not nicely compare to nil, so we have to include
-        # these wrapper methods. RUBY-179 has the task to update this on
-        # EOL of 2.4 support
         def false? config
-          return false unless config
           return false if config == true
           return true if config == false
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
         end
 
         def true? config
-          return false unless config
           return false if config == false
           return true if config == true
+          return false unless config.cs__is_a?(String)
 
           Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
         end

data/lib/contrast/utils/cache.rb

@@ -10,17 +10,6 @@ module Contrast
         @data = {}
       end
 
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
       def [] key
         found = true
         value = @data.delete(key) { found = false }

data/lib/contrast/utils/class_util.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
@@ -56,7 +57,8 @@ module Contrast
         #   https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/capture-snapshot.md
         def to_contrast_string object
           if object.cs__is_a?(String)
-            return Contrast::Utils::ObjectShare::EMPTY_STRING if object.empty?
+            cached = to_cached_string(object)
+            return cached if cached
 
             object.dup
           elsif object.cs__is_a?(Symbol)
@@ -65,6 +67,8 @@ module Contrast
             object.to_s
           elsif object.cs__is_a?(Module) || object.cs__is_a?(Class)
             "#{ object.cs__name }@#{ object.__id__ }"
+          elsif object.cs__is_a?(Regexp)
+            object.source
           else
             "#{ object.cs__class.cs__name }@#{ object.__id__ }"
           end
@@ -107,6 +111,21 @@ module Contrast
 
           mod
         end
+
+        # If the String matches a common String in our ObjectShare, return that
+        # rather that for use as the representation of the String rather than
+        # forcing a duplication of the String.
+        #
+        # @param string [String] some string of which we want a Contrast
+        #   representation.
+        # @return [String,nil] the ObjectShare version of the String or nil
+        def to_cached_string string
+          return Contrast::Utils::ObjectShare::EMPTY_STRING if string.empty?
+          return Contrast::Utils::ObjectShare::SLASH if string == Contrast::Utils::ObjectShare::SLASH
+          return Contrast::Utils::ObjectShare::EQUALS if string == Contrast::Utils::ObjectShare::EQUALS
+
+          nil
+        end
       end
     end
   end

data/lib/contrast/utils/gemfile_reader.rb

@@ -15,7 +15,7 @@ module Contrast
       include Singleton
       include Contrast::Components::Interface
 
-      access_component :logging
+      access_component :config, :logging
 
       CONTRAST_AGENT = 'contrast-agent'
 
@@ -55,9 +55,10 @@ module Contrast
           paths = get_by_digest(digest)
           path = spec.full_gem_path
           $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
+            next unless line.cs__is_a?(String)
+            next unless line.start_with?(path)
 
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
+            logger.trace('Recording loaded gem for inventory analysis', line: line)
             updated!
             paths << adjust_lib(line)
           end
@@ -137,6 +138,7 @@ module Contrast
         lib.external_ms = date_to_ms(spec.date)
         lib.internal_ms = lib.external_ms
         lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
+        # Library tags are appended in the ApplicationUpdate delegator
         update_class_counts(lib, digest, spec)
         lib
       end

data/lib/contrast/utils/hash_digest.rb

@@ -136,10 +136,6 @@ module Contrast
         @crc32 = Zlib.crc32(str, @crc32)
       end
 
-      def reset
-        @crc32 = 0
-      end
-
       def finish
         @crc32.to_s
       end

data/lib/contrast/utils/heap_dump_util.rb

@@ -9,7 +9,7 @@ module Contrast
     # Implementation of a heap dump util to automate generation
     class HeapDumpUtil
       include Contrast::Components::Interface
-      access_component :logging, :heap_dump
+      access_component :heap_dump, :logging
 
       LOG_ERROR_DUMPS = 'Unable to generate heap dumps'
       FILE_WRITE_FLAGS = 'w'
@@ -25,12 +25,13 @@ module Contrast
 
           delay = heap_dump_control[:delay]
           Contrast::Agent::Thread.new do
-            logger.info("HEAP DUMP THREAD INITIALIZED.  WAITING #{ delay } SECONDS TO BEGIN.")
+            logger.info("HEAP DUMP THREAD INITIALIZED. WAITING #{ delay } SECONDS TO BEGIN.")
             sleep(delay)
             capture_heap_dump
           end
         rescue StandardError => e
           logger.info(LOG_ERROR_DUMPS, e)
+          nil
         end
 
         def log_enabled_warning
@@ -79,21 +80,21 @@ module Contrast
           window = heap_dump_control[:window]
           count  = heap_dump_control[:count]
           clean  = heap_dump_control[:clean]
-          logger.info(nil, 'HEAP DUMP MAIN LOOP')
+          logger.info('HEAP DUMP MAIN LOOP')
           ObjectSpace.trace_object_allocations_start
           count.times do |i|
-            logger.info(nil, "STARTING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+            logger.info('STARTING HEAP DUMP PASS', current_pass: i + 1, max: count)
             output = "#{ Time.now.to_f }-heap.dump"
             output = File.join(dir, output)
             begin
-              logger.info(nil, "OPENING FILE #{ dir }/#{ output } FOR HEAP DUMP")
+              logger.info('OPENING HEADUMP FILE', dir: dir, file: output)
               file = File.new(output, FILE_WRITE_FLAGS)
               if clean
-                logger.info(nil, 'PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
+                logger.info('PERFORMING GARBAGE COLLECTION BEFORE HEAP DUMP')
                 GC.start
               end
               ObjectSpace.dump_all(output: file)
-              logger.info(nil, "FINISHING HEAP DUMP PASS #{ i + 1 } OF #{ count }")
+              logger.info('FINISHING HEAP DUMP PASS', current_pass: i + 1, max: count)
             ensure
               file.close
             end
@@ -101,10 +102,10 @@ module Contrast
           end
         ensure
           ObjectSpace.trace_object_allocations_stop
-          logger.info(nil, '*****************************************************')
-          logger.info(nil, '********        HEAP DUMP HAS CONCLUDED      ********')
-          logger.info(nil, '***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
-          logger.info(nil, '*****************************************************')
+          logger.info('*****************************************************')
+          logger.info('********        HEAP DUMP HAS CONCLUDED      ********')
+          logger.info('***     APPLICATION PROCESS WILL EXIT SHORTLY     ***')
+          logger.info('*****************************************************')
           exit # We weren't kidding!
         end
       end