contrast-agent 3.9.1 → 3.12.0

data/lib/contrast/utils/object_share.rb

@@ -9,9 +9,6 @@ module Contrast
     # duplication.
     class ObjectShare
       # Strings
-      AND =           '&'
-      OR =            '||'
-      PIPE =          '|'
       ASTERISK =      '*'
       BACK_SLASH =    '\\'
       EMPTY_STRING =  ''
@@ -27,8 +24,7 @@ module Contrast
       NEW_LINE =      "\n"
       NIL_STRING =    'nil'
       PERIOD =        '.'
-      PLUS_SIGN =     '+'
-      POUND_SIGN = HASH_CHAR = '#'
+      POUND_SIGN =    '#'
       QUESTION_MARK = '?'
       RETURN =        "\r"
       SEMICOLON =     ';'
@@ -39,35 +35,17 @@ module Contrast
       DOUBLE_UNDERSCORE = '__'
       AT =            '@'
       LEFT_ANGLE =    '<'
-      RIGHT_ANGLE =   '>'
-      LEFT_BRACKET =   '['
-      RIGHT_BRACKET =  ']'
-      LEFT_PAREN =     '('
-      RIGHT_PAREN =    ')'
       COLON_SLASH_SLASH = '://'
-      TICK =           '`'
-      BACK_TICK =      '`'
-      LEFT_CURLY =     '{'
-      RIGHT_CURLY =    '}'
       DOLLAR_SIGN =    '$'
       CARROT =         '^'
-      PERCENT =        '%'
-      LETTER_Q =       'Q'
-      OR_STRING =      'or'
 
-      DOUBLE_QUOTE_ESCAPED = '&quot;'
-
-      READ_FLAG =     'r'
       WRITE_FLAG =    'w'
-      READ_WRITE_FLAG = 'rw'
 
       PARENT_PATH =   '..'
 
       RUBY = 'Ruby'
       CACHE = 'cache'
-      GEM_SUFFIX = '.gem'
 
-      CONTRAST_METHOD_START = 'cs__'
       CONTRAST_PATCHED_METHOD_START = 'cs__patched_'
       CONTRAST_MODULE_START = 'Contrast::'
       ANONYMOUS_CLASS_MARKER = '#<'
@@ -75,13 +53,11 @@ module Contrast
 
       EMPTY_ARRAY = [].freeze
       EMPTY_HASH = {}.freeze
-      EMPTY_TRIPLE = [EMPTY_STRING, EMPTY_STRING, EMPTY_STRING].freeze
 
       # RegExps
       DIGIT_REGEXP =       /[[:digit:]]/.freeze
       WHITE_SPACE_REGEXP = /\s/.freeze
       NOT_WHITE_SPACE_REGEXP = /[^\s]/.freeze
-      WINDOWS_REGEXP = /cygwin|mswin|mingw|bccwin|wince|emx/.freeze
 
       # Messages
       OVERRIDE_MESSAGE = 'A security filter prevented original response from being returned.'
@@ -93,24 +69,11 @@ module Contrast
       CLASS = 'Class'
       MODULE = 'Module'
 
-      BRACKET_INTERPOLATION_START = '#{'
-
       OBJECT_KEY = 'O'
-      PARAMETER_KEY = 'P'
       RETURN_KEY = 'R'
       UNKNOWN = 'unknown'
 
       INDEX = 'index'
-
-      VERSION_2_5_0 = '2.5.0'
-      VERSION_2_4_2 = '2.4.2'
-      VERSION_2_4_1 = '2.4.1'
-      VERSION_2_4_0 = '2.4.0'
-      VERSION_2_3_5 = '2.3.5'
-      VERSION_2_3_4 = '2.3.4'
-      VERSION_2_3_0 = '2.3.0'
-      VERSION_2_0_4 = '2.0.4'
-      VERSION_2_0_0 = '2.0.0'
     end
   end
 end

data/lib/contrast/utils/os.rb

@@ -8,32 +8,8 @@ module Contrast
     # Utility memozies to avoid multiple lookups.
     module OS
       class << self
-        def windows?
-          @_windows = !(/cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM).nil? if @_windows.nil?
-          @_windows
-        end
-
-        def mac?
-          @_mac ||= !(/darwin/ =~ RUBY_PLATFORM).nil? if @_mac.nil?
-          @_mac
-        end
-
-        def unix?
-          @unix ||= !windows? if @_unix.nil?
-          @unix
-        end
-
-        def linux?
-          @_linux ||= unix? && !OS.mac? if @_linux.nil?
-          @_linux
-        end
-
         def running?
-          process = if Contrast::Utils::OS.windows?
-                      `tasklist /fi "imagename eq contrast-service.exe"`
-                    else
-                      `ps aux | grep contrast-servic[e]`
-                    end
+          process = `ps aux | grep contrast-servic[e]`
           process != ''
         end
 

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -5,9 +5,13 @@ cs__scoped_require 'parser/current'
 
 module Contrast
   module Utils
-    # This utility allows us to parse and rewrite the AST in Ruby 2.4 & 2.5,
+    # This utility allows us to parse and rewrite the AST in Ruby 2.5,
     # allowing us to track String interpolation propagation by replacing those
     # events with String#+ events instead.
+    #
+    # TODO: RUBY-714 remove w/ EOL of 2.5
+    # @deprecated Changes to this class are discouraged as this approach is
+    #   being phased out with support for those language versions.
     class RubyAstRewriter < Parser::TreeRewriter
       VARIABLES = %i[ivar cvar gvar].cs__freeze
 

data/lib/contrast/utils/service_response_util.rb

@@ -1,108 +1,84 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/logger/log'
+cs__scoped_require 'contrast/agent/reaction_processor'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/assess/sampling_util'
+
 module Contrast
   module Utils
     # Utility class for processing responses from the Contrast Service. Specifically, this class
     # processes Server and Application settings and updates the Settings component.
     module ServiceResponseUtil
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :settings, :analysis
+      access_component :agent, :analysis, :logging, :settings
 
       class << self
-        # TODO: RUBY-119
+        # Return true if the agent has processed a response from the service
+        def update_received?
+          @_last_update.nil?
+        end
+
         def process_response response
-          fs = Contrast::Agent::FeatureState.instance
-          fs.last_update = response&.sent_ms
+          @_last_update = response&.sent_ms
+
           server_features = process_server_response(response)
           app_settings = process_application_response(response)
 
           # ReactionProcessor is a design pattern from TeamServer.
           # Right now, there's one potential reaction, which is disabling the agent
           Contrast::Agent::ReactionProcessor.process(response&.application_settings)
-          # Determine new accumulator state
-          if (new_accum = response&.accumulator_settings)
-            SETTINGS.accumulator_settings.replace(new_accum)
-          end
 
-          fs.logger_manager.update(server_features&.log_file, server_features&.log_level)
+          Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
-          logger.debug("Agent modes: P-#{ fs.protect_enabled? ? 'ENABLED' : 'DISABLED' }, A-#{ fs.assess_enabled? ? 'ENABLED' : 'DISABLED' }")
+          logger.trace(
+              'Agent settings updated in response to Service',
+              protect_on: PROTECT.enabled?,
+              assess_on: ASSESS.enabled?)
         end
 
         private
 
         # Given some protobuf messages, update settings.
         # This is the bridge between Contrast Service <-> Settings.
-        LOG_SERVER_SETTINGS_UPDATE = 'Agent: Received updated server features'
-        LOG_UPDATE_PROTECT         = 'Updating Protect state'
-        LOG_UPDATE_ASSESS          = 'Updating Assess state'
         def process_server_response response
           server_features = response&.server_features
           return unless server_features
 
-          logger.debug(LOG_SERVER_SETTINGS_UPDATE)
-          # 'defend' is legacy for 'protect' in the dtm.
-          protect = server_features.defend
-          assess = server_features.assess
-
-          protect_enable = !!protect.enabled
-          assess_enable =  !!assess.enabled
+          logger.trace('Agent: Received updated server features')
 
-          # protect
-          begin
-            logger.debug(LOG_UPDATE_PROTECT)
-            SETTINGS.protect_state[:enabled] = protect_enable
-          end
-
-          # assess
-          begin
-            logger.debug(LOG_UPDATE_ASSESS)
-            SETTINGS.assess_state[:enabled] = assess_enable
-            SETTINGS.assess_state[:sampling_settings] = assess.sampling
-          end
+          SETTINGS.update_from_server_features(server_features)
 
           server_features
         end
 
-        MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
-        LOG_APP_SETTINGS_UPDATE = 'Agent: Received updated application settings'
         def process_application_response response
           app_settings = response&.application_settings
           return unless app_settings
 
-          logger.debug(LOG_APP_SETTINGS_UPDATE)
-          exclusion_matchers = app_settings.exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
-          protection_rules = app_settings.protection_rules.map { |pr, _hash| [pr.id, pr.mode] }
-          protection_rules.select! { |(_id, mode)| MODE_WHITELIST.include? mode }
-          modes_by_id = protection_rules.to_h
-          SETTINGS.application_state.merge!(
-              modes_by_id: modes_by_id,
-              exclusion_matchers: exclusion_matchers,
-              disabled_assess_rules: app_settings.disabled_assess_rules,
-              session_id: app_settings.session_id)
+          logger.debug('Agent: Received updated application settings')
+
+          SETTINGS.update_from_application_settings(app_settings)
 
           app_settings
         end
 
-        # This is can also go into settings/c.service, but it
-        # requires protobuf decorators to be pretty and decomposed.
-        LOG_INFO_RULE_SETTINGS = 'Current rule settings:'
+        # This can't go in the Settings component because protect and assess depend on settings
+        # I don't think it should go into contrast_service because that only handles connection specific data
         def update_features server_features, app_settings
-          if !!(server_features || app_settings)
-            logger.debug_with_time('Rebuilding rule modes') do
-              SETTINGS.build_protect_rules if PROTECT.enabled?
-              SETTINGS.build_assess_rules  if ASSESS.enabled?
-
-              logger.info(LOG_INFO_RULE_SETTINGS)
-              PROTECT.rules.each { |k, v| logger.info(".. protect: #{ k } (#{ v.mode })") }
-              ASSESS.rules.each { |k, v| logger.info(".. assess:  #{ k } (#{ v.enabled? })") }
-            end
-          end
+          return unless !!(server_features || app_settings)
+          return unless AGENT.enabled?
+
+          logger.trace_with_time('Rebuilding rule modes') do
+            SETTINGS.build_protect_rules if PROTECT.enabled?
+            SETTINGS.build_assess_rules  if ASSESS.enabled?
+            AGENT.reset_ruleset
 
-          # This is for assess
-          # PERF, we could avoid here with dirty-tracking.
-          Contrast::Utils::Assess::SamplingUtil.instance.update
+            logger.info('Current rule settings:')
+            PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
+            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+          end
         end
       end
     end

data/lib/contrast/utils/service_sender_util.rb

@@ -13,11 +13,9 @@ module Contrast
     # to SpeedRacer.
     module ServiceSenderUtil
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging, :analysis, :agent
+      access_component :analysis, :app_context, :logging, :settings
 
       class << self
-        attr_reader :assess_messages, :ready_messages_queue
-
         # Push the given DTM into a queue to be sent to the Service.
         #
         # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
@@ -25,33 +23,49 @@ module Contrast
         def push_to_ready_queue event
           return unless event
 
-          # Since a message may try to be pushed before sending_thread starts up, we need to initialize
-          # the queue on first message sent
-          @ready_messages_queue ||= Queue.new
+          prep_queue
           ready_messages_queue.push event
-          logger.debug("Enqueued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
+          logger.debug('Enqueued event',
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name,
+                       queue: ready_messages_queue.__id__,
+                       length: ready_messages_queue.length)
+        end
+
+        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
+        # to receive the response object back from SpeedRacer. An invoking method that needs
+        # to process the response object with custom logic should use this method.
+        #
+        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
+        #   field of Contrast::Api::Dtm::Message
+        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
+        def send_event_immediately event
+          client.send_to_speedracer(event) if event
         end
 
         def sending_thread
-          # in case we got here before a message attempted to be sent, let's make sure these are initialized
-          @ready_messages_queue ||= Queue.new
-          @assess_messages ||= []
+          return @_sender_thread if @_sender_thread
 
+          # in case we got here before a message attempted to be sent, let's make sure these are initialized
           @_sender_thread ||= Contrast::Agent::Thread.new do
             loop do
-              check_assess_queue if assess_messages # don't bother checking if assess queue is already cleared
+              check_assess_queue
               # if ready messages queue is empty, calling thread is suspended until a message is pushed onto queue
               event = ready_messages_queue.pop
               begin
-                logger.debug("Dequeued the #{ event.cs__class.name } event #{ event.__id__ }.") # TODO: RUBY-794 make Type & ID structured for parsing)
-                response = Contrast::Agent::FeatureState.instance.client.send_to_speedracer event
+                logger.debug('Dequeued event',
+                             event_id: event.__id__,
+                             event_type: event.cs__class.name,
+                             queue: ready_messages_queue.__id__,
+                             length: ready_messages_queue.length)
+                response = client.send_to_speedracer(event)
                 Contrast::Utils::ServiceResponseUtil.process_response(response) if response
               rescue StandardError => e
-                logger.error(e, 'Could not send message to service from service sender thread.')
+                logger.error('Could not send message to service from service sender thread.', e)
               end
             end
           end
-          logger.debug(nil, 'Started background sending thread.')
+          logger.debug('Started background sending thread.')
         end
         alias_method :start, :sending_thread
 
@@ -60,17 +74,64 @@ module Contrast
         end
 
         def add_to_assess_messages msg
-          # This list holds messages containing assess findings. We currently
-          # do not know if the agent is running in assess, so until we do then
-          # we must keep the messages stored here.
-          @assess_messages ||= []
-          assess_messages << msg
+          assess_messages! << msg
+        end
+
+        # Return true if the agent has connected with the service
+        def connection_established?
+          client.connection_established?
         end
 
         private
 
+        # TODO: RUBY-920
+        # If we've been forked, then we need to make sure the sender is set and
+        # alive. This is a temporary workaround to address issues in Passenger
+        # around forking and will be addressed next sprint.
+        def prep_queue
+          return if @_sender_thread&.alive?
+
+          @_sender_thread = nil
+          start
+        end
+
+        def ready_messages_queue
+          @_ready_messages_queue ||= begin
+                                       tmp = Queue.new
+                                       logger.debug('Creating new ready_messages_queue.',
+                                                    queue: tmp.__id__,
+                                                    length: tmp.length)
+                                       tmp
+                                     end
+        end
+
+        def assess_messages!
+          unless @_assess_messages
+            logger.debug('Creating new assess messages queue by force.')
+            @_assess_messages = nil
+          end
+          assess_messages
+        end
+
+        # This list holds messages containing assess findings. We may not
+        # know if the agent is running in assess, so until we do then we
+        # must keep the messages stored here. Once we do know, we'll set this
+        # to `false` and rely on the standard ready_messages_queue
+        def assess_messages
+          if @_assess_messages.nil?
+            logger.debug('Creating new assess messages queue.')
+            @_assess_messages = []
+          end
+          @_assess_messages
+        end
+
+        def client
+          @_client ||= Contrast::Agent::SocketClient.new
+        end
+
         def check_assess_queue
-          return unless AGENT.ready?
+          return unless assess_messages
+          return unless APP_CONTEXT.ready?
 
           if ASSESS.enabled?
             assess_messages.each do |msg|
@@ -78,7 +139,7 @@ module Contrast
               ready_messages_queue.push msg # this message is ready to be sent to SR
             end
           end
-          @assess_messages = nil # clear out queue, we no longer need it
+          @_assess_messages = false # clear out queue, we no longer need it
         end
 
         # When we queued up findings, we didn't have access to a configuration
@@ -97,7 +158,7 @@ module Contrast
           end
 
           msg.findings.each do |finding|
-            finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+            finding.session_id = SETTINGS.session_id
           end
         end
       end