contrast-agent 3.9.0 → 3.11.0

data/lib/contrast/utils/invalid_configuration_util.rb

@@ -54,7 +54,7 @@ module Contrast
           Contrast::Utils::ServiceSenderUtil.add_to_assess_messages activity
         end
       rescue StandardError => e
-        logger.error(e, "Unable to build a finding for #{ rule_id }")
+        logger.error('Unable to build a finding', e, rule: rule_id)
       end
 
       private

data/lib/contrast/utils/inventory_util.rb

@@ -29,7 +29,7 @@ module Contrast
       def self.inventory_class class_path
         Contrast::Utils::GemfileReader.instance.map_class(class_path)
       rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
+        logger.error('Unable to inventory module', e, path: class_path)
       end
 
       def self.active_record_config
@@ -56,7 +56,7 @@ module Contrast
           activity_or_update.technologies[a.vendor] = true
         end
       rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
+        logger.error('Unable to append db config', e)
         nil
       end
 

data/lib/contrast/utils/io_util.rb

@@ -11,16 +11,6 @@ module Contrast
 
       access_component :logging
 
-      # StringIO is a valid path because it logs directly to a string buffer
-      def self.write_permission? path
-        return false if path.nil?
-        return true if path.is_a?(StringIO)
-        return File.writable?(path) if File.exist?(path)
-
-        dir_name = File.dirname(File.absolute_path(path))
-        File.writable?(dir_name)
-      end
-
       # We're only going to call rewind on things that we believe are safe to
       # call it on. This method white lists those cases and returns false in
       # all others.
@@ -30,7 +20,7 @@ module Contrast
 
         should_rewind_io?(potential_io)
       rescue StandardError => e
-        logger.debug(e, "Encountered an issue inspecting instance of #{ potential_io } - continuing without rewind")
+        logger.debug('Encountered an issue determining if rewindable', e, module: potential_io.cs__class.name)
         false
       end
 

data/lib/contrast/utils/job_servers_running.rb

@@ -17,7 +17,7 @@ module Contrast
         def sidekiq_running?
           return unless defined?(Sidekiq) && Sidekiq.cs__respond_to?(:server?) && Sidekiq.server?
 
-          logger.debug(nil, 'Detected the spawn of a Sidekiq process')
+          logger.trace('Detected the spawn of a Sidekiq process')
           true
         end
 
@@ -30,7 +30,7 @@ module Contrast
           has_disabled_task = Rake.application.top_level_tasks.any? { |top_level_task| disabled_rake_tasks.include?(top_level_task) }
           return false unless has_disabled_task
 
-          logger.debug(nil, 'Detected startup within Rake task')
+          logger.trace('Detected startup within Rake task')
           true
         end
       end

data/lib/contrast/utils/object_share.rb

@@ -10,8 +10,6 @@ module Contrast
     class ObjectShare
       # Strings
       AND =           '&'
-      OR =            '||'
-      PIPE =          '|'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
@@ -27,8 +25,7 @@ module Contrast
       NEW_LINE =      "\n"
       NIL_STRING =    'nil'
       PERIOD =        '.'
-      PLUS_SIGN =     '+'
-      POUND_SIGN = HASH_CHAR = '#'
+      POUND_SIGN =    '#'
       QUESTION_MARK = '?'
       RETURN =        "\r"
       SEMICOLON =     ';'
@@ -39,35 +36,17 @@ module Contrast
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'
       LEFT_ANGLE =    '<'
-      RIGHT_ANGLE =   '>'
-      LEFT_BRACKET =   '['
-      RIGHT_BRACKET =  ']'
-      LEFT_PAREN =     '('
-      RIGHT_PAREN =    ')'
       COLON_SLASH_SLASH = '://'
-      TICK =           '`'
-      BACK_TICK =      '`'
-      LEFT_CURLY =     '{'
-      RIGHT_CURLY =    '}'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
-      PERCENT =        '%'
-      LETTER_Q =       'Q'
-      OR_STRING =      'or'
 
-      DOUBLE_QUOTE_ESCAPED = '&quot;'
-
-      READ_FLAG =     'r'
       WRITE_FLAG =    'w'
-      READ_WRITE_FLAG = 'rw'
 
       PARENT_PATH =   '..'
 
       RUBY = 'Ruby'
       CACHE = 'cache'
-      GEM_SUFFIX = '.gem'
 
-      CONTRAST_METHOD_START = 'cs__'
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
       CONTRAST_MODULE_START = 'Contrast::'
       ANONYMOUS_CLASS_MARKER = '#<'
@@ -75,13 +54,11 @@ module Contrast
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze
-      EMPTY_TRIPLE = [EMPTY_STRING, EMPTY_STRING, EMPTY_STRING].freeze
 
       # RegExps
       DIGIT_REGEXP =       /[[:digit:]]/.freeze
       WHITE_SPACE_REGEXP = /\s/.freeze
       NOT_WHITE_SPACE_REGEXP = /[^\s]/.freeze
-      WINDOWS_REGEXP = /cygwin|mswin|mingw|bccwin|wince|emx/.freeze
 
       # Messages
       OVERRIDE_MESSAGE = 'A security filter prevented original response from being returned.'
@@ -93,24 +70,11 @@ module Contrast
       CLASS = 'Class'
       MODULE = 'Module'
 
-      BRACKET_INTERPOLATION_START = '#{'
-
       OBJECT_KEY = 'O'
-      PARAMETER_KEY = 'P'
       RETURN_KEY = 'R'
       UNKNOWN = 'unknown'
 
       INDEX = 'index'
-
-      VERSION_2_5_0 = '2.5.0'
-      VERSION_2_4_2 = '2.4.2'
-      VERSION_2_4_1 = '2.4.1'
-      VERSION_2_4_0 = '2.4.0'
-      VERSION_2_3_5 = '2.3.5'
-      VERSION_2_3_4 = '2.3.4'
-      VERSION_2_3_0 = '2.3.0'
-      VERSION_2_0_4 = '2.0.4'
-      VERSION_2_0_0 = '2.0.0'
     end
   end
 end

data/lib/contrast/utils/os.rb

@@ -8,32 +8,8 @@ module Contrast
     # Utility memozies to avoid multiple lookups.
     module OS
       class << self
-        def windows?
-          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil? if @_windows.nil?
-          @_windows
-        end
-
-        def mac?
-          @_mac ||= !(/darwin/ =~ RUBY_PLATFORM).nil? if @_mac.nil?
-          @_mac
-        end
-
-        def unix?
-          @unix ||= !windows? if @_unix.nil?
-          @unix
-        end
-
-        def linux?
-          @_linux ||= unix? && !OS.mac? if @_linux.nil?
-          @_linux
-        end
-
         def running?
-          process = if Contrast::Utils::OS.windows?
-                      `tasklist /fi "imagename eq contrast-service.exe"`
-                    else
-                      `ps aux | grep contrast-servic[e]`
-                    end
+          process = `ps aux | grep contrast-servic[e]`
           process != ''
         end
 

data/lib/contrast/utils/rack_assess_session_cookie.rb

@@ -55,7 +55,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to secure session', e)
+            logger.error('Unable to track call to secure session', e)
           rescue StandardError
             nil
           end
@@ -76,7 +76,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to set session timeout', e)
+            logger.error('Unable to track call to set session timeout', e)
           rescue StandardError
             nil
           end
@@ -93,7 +93,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to httponly', e)
+            logger.error('Unable to track call to httponly', e)
           rescue StandardError
             nil
           end

data/lib/contrast/utils/rails_assess_configuration.rb

@@ -52,7 +52,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to set session timeout', e)
+            logger.error('Unable to track call to set session timeout', e)
           rescue StandardError
             nil
           end
@@ -68,7 +68,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to disable secure cookies', e)
+            logger.error('Unable to track call to disable secure cookies', e)
           rescue StandardError
             nil
           end
@@ -84,7 +84,7 @@ module Contrast
           end
         rescue StandardError => e
           begin
-            logger.log_error('Unable to track call to disable httponly in session cookie', e)
+            logger.error('Unable to track call to disable httponly in session cookie', e)
           rescue StandardError
             nil
           end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -5,9 +5,13 @@ cs__scoped_require 'parser/current'
 
 module Contrast
   module Utils
-    # This utility allows us to parse and rewrite the AST in Ruby 2.4 & 2.5,
+    # This utility allows us to parse and rewrite the AST in Ruby 2.5,
     # allowing us to track String interpolation propagation by replacing those
     # events with String#+ events instead.
+    #
+    # TODO: RUBY-714 remove w/ EOL of 2.5
+    # @deprecated Changes to this class are discouraged as this approach is
+    #   being phased out with support for those language versions.
     class RubyAstRewriter < Parser::TreeRewriter
       VARIABLES = %i[ivar cvar gvar].cs__freeze
 

data/lib/contrast/utils/service_response_util.rb

@@ -1,19 +1,24 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/logger'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/assess/sampling_util'
+
 module Contrast
   module Utils
     # Utility class for processing responses from the Contrast Service. Specifically, this class
     # processes Server and Application settings and updates the Settings component.
     module ServiceResponseUtil
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :settings, :analysis
+      access_component :analysis, :contrast_service, :logging, :settings
 
       class << self
         # TODO: RUBY-119
         def process_response response
           fs = Contrast::Agent::FeatureState.instance
           fs.last_update = response&.sent_ms
+
           server_features = process_server_response(response)
           app_settings = process_application_response(response)
 
@@ -25,84 +30,53 @@ module Contrast
             SETTINGS.accumulator_settings.replace(new_accum)
           end
 
-          fs.logger_manager.update(server_features&.log_file, server_features&.log_level)
+          Contrast::Agent::Logger.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
-          logger.debug("Agent modes: P-#{ fs.protect_enabled? ? 'ENABLED' : 'DISABLED' }, A-#{ fs.assess_enabled? ? 'ENABLED' : 'DISABLED' }")
+          logger.trace(
+              'Agent settings updated in response to Service',
+              protect_on: fs.protect_enabled?,
+              assess_on: fs.assess_enabled?)
         end
 
         private
 
         # Given some protobuf messages, update settings.
         # This is the bridge between Contrast Service <-> Settings.
-        LOG_SERVER_SETTINGS_UPDATE = 'Agent: Received updated server features'
-        LOG_UPDATE_PROTECT         = 'Updating Protect state'
-        LOG_UPDATE_ASSESS          = 'Updating Assess state'
         def process_server_response response
           server_features = response&.server_features
           return unless server_features
 
-          logger.debug(LOG_SERVER_SETTINGS_UPDATE)
-          # 'defend' is legacy for 'protect' in the dtm.
-          protect = server_features.defend
-          assess = server_features.assess
-
-          protect_enable = !!protect.enabled
-          assess_enable =  !!assess.enabled
-
-          # protect
-          begin
-            logger.debug(LOG_UPDATE_PROTECT)
-            SETTINGS.protect_state[:enabled] = protect_enable
-          end
+          logger.trace('Agent: Received updated server features')
 
-          # assess
-          begin
-            logger.debug(LOG_UPDATE_ASSESS)
-            SETTINGS.assess_state[:enabled] = assess_enable
-            SETTINGS.assess_state[:sampling_settings] = assess.sampling
-          end
+          SETTINGS.update_from_server_features(server_features)
 
           server_features
         end
 
-        MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
-        LOG_APP_SETTINGS_UPDATE = 'Agent: Received updated application settings'
         def process_application_response response
           app_settings = response&.application_settings
           return unless app_settings
 
-          logger.debug(LOG_APP_SETTINGS_UPDATE)
-          exclusion_matchers = app_settings.exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
-          protection_rules = app_settings.protection_rules.map { |pr, _hash| [pr.id, pr.mode] }
-          protection_rules.select! { |(_id, mode)| MODE_WHITELIST.include? mode }
-          modes_by_id = protection_rules.to_h
-          SETTINGS.application_state.merge!(
-              modes_by_id: modes_by_id,
-              exclusion_matchers: exclusion_matchers,
-              disabled_assess_rules: app_settings.disabled_assess_rules,
-              session_id: app_settings.session_id)
+          logger.debug('Agent: Received updated application settings')
+
+          SETTINGS.update_from_application_settings(app_settings)
 
           app_settings
         end
 
-        # This is can also go into settings/c.service, but it
-        # requires protobuf decorators to be pretty and decomposed.
-        LOG_INFO_RULE_SETTINGS = 'Current rule settings:'
+        # This can't go in the Settings component because protect and assess depend on settings
+        # I don't think it should go into contrast_service because that only handles connection specific data
         def update_features server_features, app_settings
-          if !!(server_features || app_settings)
-            logger.debug_with_time('Rebuilding rule modes') do
-              SETTINGS.build_protect_rules if PROTECT.enabled?
-              SETTINGS.build_assess_rules  if ASSESS.enabled?
-
-              logger.info(LOG_INFO_RULE_SETTINGS)
-              PROTECT.rules.each { |k, v| logger.info(".. protect: #{ k } (#{ v.mode })") }
-              ASSESS.rules.each { |k, v| logger.info(".. assess:  #{ k } (#{ v.enabled? })") }
-            end
-          end
+          return unless !!(server_features || app_settings)
 
-          # This is for assess
-          # PERF, we could avoid here with dirty-tracking.
-          Contrast::Utils::Assess::SamplingUtil.instance.update
+          logger.trace_with_time('Rebuilding rule modes') do
+            SETTINGS.build_protect_rules if PROTECT.enabled?
+            SETTINGS.build_assess_rules  if ASSESS.enabled?
+
+            logger.info('Current rule settings:')
+            PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
+            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+          end
         end
       end
     end

data/lib/contrast/utils/service_sender_util.rb

@@ -13,7 +13,7 @@ module Contrast
     # to SpeedRacer.
     module ServiceSenderUtil
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :analysis, :agent
+      access_component :agent, :analysis, :contrast_service, :logging
 
       class << self
         attr_reader :assess_messages, :ready_messages_queue
@@ -29,7 +29,9 @@ module Contrast
           # the queue on first message sent
           @ready_messages_queue ||= Queue.new
           ready_messages_queue.push event
-          logger.debug("Enqueued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
+          logger.debug('Enqueued event',
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
         end
 
         def sending_thread
@@ -43,15 +45,17 @@ module Contrast
               # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
               event = ready_messages_queue.pop
               begin
-                logger.debug("Dequeued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
+                logger.debug('Dequeued event',
+                             event_id: event.__id__,
+                             event_type: event.cs__class.name)
                 response = Contrast::Agent::FeatureState.instance.client.send_to_speedracer event
                 Contrast::Utils::ServiceResponseUtil.process_response(response) if response
               rescue StandardError => e
-                logger.error(e, 'Could not send message to service from service sender thread.')
+                logger.error('Could not send message to service from service sender thread.', e)
               end
             end
           end
-          logger.debug(nil, 'Started background sending thread.')
+          logger.debug('Started background sending thread.')
         end
         alias_method :start, :sending_thread
 

data/lib/contrast/utils/sinatra_helper.rb

@@ -33,12 +33,6 @@ module Contrast
         end
       end
 
-      def self.settings_instance
-        @_settings_instance ||= begin
-                                  app_class&.settings
-                                end
-      end
-
       def self.view_directory
         @_view_directory ||= begin
           app_class&.settings&.views