contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/cache.rb

@@ -1,69 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Implementation taken from http://stackoverflow.com/questions/1933866/efficient-ruby-lru-cache
-    class Cache
-      def initialize max_size = 1000
-        @max_size = max_size
-        @data = {}
-      end
-
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
-      def [] key
-        found = true
-        value = @data.delete(key) { found = false }
-        @data[key] = value if found
-      end
-
-      def []= key, value
-        @data.delete(key)
-        @data[key] = value
-        @data.delete(@data.first[0]) if @data.length > @max_size
-
-        value # rubocop:disable Lint/Void
-      end
-
-      def each
-        @data.reverse_each do |pair|
-          yield pair
-        end
-      end
-
-      # used further up the chain, non thread safe each
-      alias_method :each_unsafe, :each
-
-      def to_a
-        @data.to_a.reverse
-      end
-
-      def delete key
-        @data.delete(key)
-      end
-
-      def clear
-        @data.clear
-      end
-
-      def count
-        @data.count
-      end
-
-      # for cache validation only, ensures all is sound
-      def valid?
-        true
-      end
-    end
-  end
-end

data/lib/contrast/utils/comment_range.rb

@@ -1,19 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Stores the range of a comment
-    class CommentRange
-      COMMENT_START = /<!--/.cs__freeze
-      COMMENT_END = '-->'
-
-      attr_reader :open, :close
-
-      def initialize open_idx, close_idx
-        @open = open_idx
-        @close = close_idx
-      end
-    end
-  end
-end

data/lib/contrast/utils/data_store_util.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility class used to determine information about the current data store
-    # on which a query was executed or to which the application is connected.
-    module DataStoreUtil
-      def self.report_data_store data_store
-        return unless data_store
-
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context&.activity
-
-        context.activity.technologies[data_store] = true
-        context.activity.query_count += 1
-        return unless context.activity.query_count == 1
-
-        Contrast::Utils::InventoryUtil.append_db_config(context.activity)
-      end
-    end
-  end
-end

data/lib/contrast/utils/environment_util.rb

@@ -1,82 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'socket'
-
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-
-module Contrast
-  module Utils
-    # Gather information about the application and server environment
-    # that the agent is running in.
-    class EnvironmentUtil
-      CS_VERSION = 'VERSION'
-
-      # Possible names of constants that would hold version info
-      # TODO - RUBY-770
-      VERSION_CONSTANT_CANDIDATES = %w[
-        VERSION
-        ::VERSION
-        Version::VERSION
-        ::Version::VERSION
-        ::Application::VERSION
-      ].cs__freeze
-
-      class << self
-        ######### These are helpers ####################
-
-        def present? str
-          !str.nil? && !str.to_s.empty?
-        end
-
-        ######### Actually env/framework dependent ####################
-
-        # See CONTRAST-16380 for more details
-        # TODO RUBY-770
-        def determine_application_version
-          @_determine_application_version ||= begin
-            candidates = VERSION_CONSTANT_CANDIDATES.map do |name|
-              # If there's a constant named 'name' (VERSION, etc.), get its value.
-              begin
-                name.split('::').inject(Object) do |mod, class_name|
-                  mod.cs__const_get(class_name)
-                end
-              rescue LoadError, StandardError
-                nil
-              end
-            end
-            candidates.compact!
-            candidate = candidates.first || ENV[CS_VERSION]
-
-            case candidate
-            when Hash
-              candidate.values.join(Contrast::Utils::ObjectShare::PERIOD)
-            when Array
-              candidate.join(Contrast::Utils::ObjectShare::PERIOD)
-            when String
-              candidate
-            when NilClass
-              return nil
-            else
-              candidate.inspect
-            end
-          end
-        end
-
-        # Read libraries from the gemfile and append to the given ApplicationUpdate message
-        # or other class that has a libraries map association
-        # TODO - RUBY-770
-        def add_library_to_app_update app_update_pb, library_tags = ''
-          libraries = Contrast::Utils::GemfileReader.instance.library_pb_list
-          libraries.each do |n|
-            n.tags = library_tags
-            app_update_pb.libraries[n.hash_code] = n
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/freeze_util.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/duck_utils'
-
-module Contrast
-  module Utils
-    # This utility allows us to act on frozen objects, creating an unfrozen
-    # duplicate in those cases where that is possible.
-    class FreezeUtil
-      class << self
-        # Make every attempt to duplicate the frozen object so that it can
-        # be tracked.
-        #
-        # @param original [Object] something frozen, usually a String
-        # @return [Object] the original or an unfrozen copy
-        def unfreeze_dup original
-          return original unless original.cs__frozen?
-
-          copy = original.dup
-          if Contrast::Utils::DuckUtils.iterable_hash?(copy)
-            copy.each_key do |key|
-              value = original[key]
-              copy[key] = value.dup
-            end
-          end
-          copy
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/gemfile_reader.rb

@@ -1,191 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'set'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/api'
-
-module Contrast
-  module Utils
-    # GemfileReader has methods for extracting information from gem specs
-    # it also has a cache of library file digests to the lines of code found.
-    class GemfileReader
-      include Singleton
-      include Contrast::Components::Interface
-
-      access_component :logging
-
-      CONTRAST_AGENT = 'contrast-agent'
-
-      def initialize
-        # Map of a Gem's Spec Digest to all loaded files from that Gem
-        @spec_to_files = {}
-      end
-
-      # the #clone is necessary here, as a require in another thread could
-      # potentially result in adding a key to the loaded_specs hash during
-      # iteration.  (as in RUBY-330)
-      def loaded_specs
-        Gem.loaded_specs.clone
-      end
-
-      # indicates if there's been an update to library information, allowing us
-      # to only serialize this information on change.
-      def updated?
-        @updated
-      end
-
-      def updated!
-        @updated = true
-      end
-
-      # Once we're Contrasted, we intercept require calls to do inventory.
-      # In order to catch up, we do a one-time manual catchup, & inventory
-      # all the already-loaded gems.
-      def map_loaded_classes
-        loaded_specs.each do |name, spec|
-          # Don't count Contrast gems
-          next if contrast_gems.include? name
-
-          # Get a digest of the Gem file itself
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          paths = get_by_digest(digest)
-          path = spec.full_gem_path
-          $LOADED_FEATURES.each do |line|
-            next unless line.to_s.start_with?(path)
-
-            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
-            updated!
-            paths << adjust_lib(line)
-          end
-        end
-      end
-
-      def map_class path
-        path = adjust_lib(path)
-
-        return unless (spec   = Gem::Specification.find_by_path(path))
-        return unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-        updated!
-        get_by_digest(digest) << path
-      end
-
-      def library_pb_list
-        loaded_specs.each_with_object([]) do |(name, spec), arr|
-          next if contrast_gems.include? name
-          next unless spec
-          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
-
-          arr << build_library_pb(digest, spec)
-        end
-      end
-
-      def generate_library_usage activity = nil
-        return unless updated?
-
-        @spec_to_files.each_pair do |digest, files|
-          usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
-          usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
-          activity.library_usages[usage.hash_code] = usage if activity
-          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
-          #   send the class names in usage.class_names
-          usage.count = files.size
-        end
-        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
-        #   @updated variable
-
-        # @spec_to_files.clear
-        @updated = false
-      end
-
-      private
-
-      # marker for the lib dir in an absolute file path. purposefully includes
-      # the trailing '/'
-      LIB = '/lib/'
-
-      # Kernel#load uses the absolute path, but Gems / Specs use the path after
-      # `/lib`. This method accounts for that and trims out the `/lib/` section
-      # and starts with the first `/` after and the trailing file extension, if
-      # present.
-      #
-      # @param path [String] the path to parse
-      # @return [String] the relative path of the file, after the lib directory
-      def adjust_lib path
-        idx = path.index(LIB)
-        path = path[(idx + 4)..-1] if idx
-        idx = path.rindex(Contrast::Utils::ObjectShare::PERIOD)
-        path = path[0..idx] if idx
-        path
-      end
-
-      def get_by_digest digest
-        @spec_to_files[digest] = Set.new unless @spec_to_files.key?(digest)
-        @spec_to_files[digest]
-      end
-
-      def build_library_pb digest, spec
-        lib             = Contrast::Api::Dtm::Library.new
-        lib.file_path   = Contrast::Utils::StringUtils.force_utf8(spec.name)
-        lib.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
-        lib.version     = Contrast::Utils::StringUtils.force_utf8(spec.version)
-        lib.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(spec))
-        lib.external_ms = date_to_ms(spec.date)
-        lib.internal_ms = lib.external_ms
-        lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
-        update_class_counts(lib, digest, spec)
-        lib
-      end
-
-      def date_to_ms date
-        (date.to_f * 1000.0).to_i
-      end
-
-      def update_class_counts lib, digest, spec
-        # Updating the class counts
-        path = spec.full_gem_path.to_s
-        lib.class_count = all_files(path).length
-        lib.used_class_count = @spec_to_files.key?(digest) ? get_by_digest(digest).size : 0
-        lib
-      end
-
-      def build_manifest spec
-        Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s) if defined?(YAML)
-      rescue StandardError
-        nil
-      end
-
-      # These are all the code files that are located in the Gem directory loaded
-      # by the current environment; this includes more than Ruby files
-      def all_files path
-        Contrast::Utils::Sha256Builder.instance.files(path)
-      end
-
-      # Go through all dependents, given as a pair from the DependencyList: `dependency`
-      # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
-      # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
-      # then contrast depends on it. If its array of dependents is 1, then contrast is the
-      # only dependency in that list. Since only contrast depends on it, we should ignore it.
-      def contrast_gems
-        @_contrast_gems ||= find_contrast_gems
-      end
-
-      def find_contrast_gems
-        ignore = Set.new([CONTRAST_AGENT])
-        contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
-          dependency.name == CONTRAST_AGENT
-        end
-        contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
-
-        Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
-          ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
-        end
-        ignore
-      end
-    end
-  end
-end

data/lib/contrast/utils/inventory_util.rb

@@ -1,126 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # Utilities for getting inventory information from the application
-    class InventoryUtil
-      include Contrast::Components::Interface
-      access_component :logging
-
-      # TeamServer only accepts certain values for ArchitectureComponents.
-      # DO NOT CHANGE THIS!
-      AC_TYPE_DB = 'db'
-      # TeamServer only accepts certain values for FlowMap Services.
-      # DO NOT CHANGE THIS
-      DATABASE = 'Database'
-      ADAPTER = 'adapter'
-      HOST = 'host'
-      PORT = 'port'
-      DATABASE_LOWER = 'database'
-      DEFAULT = 'default'
-      LOCALHOST = 'localhost'
-
-      def self.inventory_class class_path
-        Contrast::Utils::GemfileReader.instance.map_class(class_path)
-      rescue StandardError => e
-        logger.error(e, "Unable to inventory #{ class_path }")
-      end
-
-      def self.active_record_config
-        return @_active_record_config if instance_variable_defined?(:@_active_record_config)
-
-        @_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
-      end
-
-      def self.append_db_config activity_or_update, hash_or_str = Contrast::Utils::InventoryUtil.active_record_config
-        arr = build_from_db_config(hash_or_str)
-        return unless arr&.any?
-
-        activity_or_update.technologies[DATABASE] = true
-        arr.each do |a|
-          next unless a
-
-          if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
-            activity_or_update.architectures << a
-          else
-            activity_or_update.components << a
-          end
-          next if a.vendor.empty?
-
-          activity_or_update.technologies[a.vendor] = true
-        end
-      rescue StandardError => e
-        logger.error(e, 'Unable to append db config')
-        nil
-      end
-
-      def self.build_from_db_config hash_or_str
-        return unless hash_or_str
-
-        if hash_or_str.is_a?(Hash)
-          build_from_db_hash(hash_or_str)
-        else
-          build_from_db_string(hash_or_str.to_s)
-        end
-      end
-
-      def self.build_from_db_hash hash
-        ac = Contrast::Api::Dtm::ArchitectureComponent.new
-        ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
-        ac.remote_host = host_from_hash(hash)
-        ac.remote_port = port_from_hash(hash)
-        ac.type = AC_TYPE_DB
-        ac.url = hash[:database] || hash[DATABASE_LOWER] || DEFAULT
-        [ac]
-      end
-
-      def self.host_from_hash hash
-        hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
-
-      def self.port_from_hash hash
-        p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
-        p.to_i
-      end
-
-      # Examples:
-      # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
-      # postgresql://scott:tiger@localhost/mydatabase
-      # mysql+mysqlconnector://scott:tiger@localhost/foo
-      def self.build_from_db_string str
-        adapter, hosts, database = split_connection_str(str)
-        acs = []
-        hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
-          host, port = s.split(Contrast::Utils::ObjectShare::COLON)
-
-          ac = Contrast::Api::Dtm::ArchitectureComponent.new
-          ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
-          ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
-          ac.remote_port = port.to_i
-          ac.type = AC_TYPE_DB
-          ac.url = Contrast::Utils::StringUtils.force_utf8(database)
-          acs << ac
-        end
-        acs
-      end
-
-      def self.split_connection_str str
-        adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
-        _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
-        # Not currently used
-        # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
-        hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
-        hosts << LOCALHOST if hosts.empty?
-        database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
-
-        [adapter, hosts, database]
-      end
-    end
-  end
-end

data/lib/contrast/utils/performs_logging.rb

@@ -1,152 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This utility allows us wrap our calls to logging, allowing runtime
-    # determination as to whether or not an event should be logged, based upon
-    # the Logging Configuration as specified in Common Configuration.
-    module PerformsLogging
-      include Contrast::Components::Interface
-
-      COULDNT_INIT_CONFIG = '!!! Contrast could not initialize agent from config, flushing loq queue to TARGET !!!'
-      FLUSHING_LOG_QUEUE  = '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-
-      TARGET = STDOUT
-
-      # idiom for propagating class methods
-      def self.included base
-        base.send :include, InstanceMethods
-        base.extend ClassMethods
-      end
-
-      # Grouping to allow for these methods to be included into another Module
-      # on include of the PerformsLogging Module. They'll function as instance
-      # methods in that Module.
-      module InstanceMethods #:nodoc:
-        @_log_mutex = Mutex.new
-        @_log_queue = []
-
-        protected
-
-        def init_log_queueing
-          # Queue log messages & defer logging until logger gets initialized.
-          # (Logger depends on config, so logging config errors implies
-          # circular dependencies.)
-          at_exit do
-            # Ideally we flush the queue when we detect agent init is impossible,
-            # if worse comes to worse we do it here.
-            if @_log_queue
-              lq = @_log_queue
-              if lq&.any?
-                TARGET.puts '!!! Contrast exited before logger could initialize, flushing log queue to TARGET !!!'
-                while (message = lq.pop)
-                  TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-                end
-              end
-            end
-          end
-        end
-
-        def abort_log_queues
-          TARGET.puts COULDNT_INIT_CONFIG
-          if @_log_queue
-            TARGET.puts FLUSHING_LOG_QUEUE
-            while (message = @_log_queue.pop)
-              TARGET.puts "[#{ message[2].upcase }]\t#{ message[1] }"
-            end
-          end
-          @_log_queue = nil
-          @_log_mutex = nil
-        end
-
-        def flush_log_queues
-          return unless @_log_queue
-
-          # Monkeypatch this class so that the next call to #instance flushes the log queue.
-          # (Flushing the log queue within #initialize
-          # causes a deadlock, as singleton classes' #initialize
-          # gets wrapped within a mutex, and our logger will
-          # try to reference the singleton instance.)
-          self.class.class_eval do
-            class << self
-              alias_method :__instance_original, :instance
-              def instance
-                @_log_mutex.synchronize do
-                  # Restore old #instance method.
-                  class_eval do
-                    class << self
-                      def instance
-                        __instance_original
-                      end
-                    end
-                  end
-                  # Flush log queue.
-                  if @_log_queue
-                    while (message = @_log_queue.pop)
-                      log_with_level(*message, skip_queue: true)
-                    end
-                  end
-                  @_log_queue = nil
-                end
-                @_log_mutex = nil
-                __instance_original
-              end
-            end
-          end
-        end
-      end
-
-      module ClassMethods #:nodoc:
-        def log_error msg, exception = nil
-          log_with_level exception, msg, :error
-        end
-
-        def log_warn msg, exception = nil
-          log_with_level exception, msg, :warn
-        end
-
-        def log_info msg, exception = nil
-          log_with_level exception, msg, :info
-        end
-
-        def log_debug msg, exception = nil
-          log_with_level exception, msg, :debug
-        end
-
-        def debug_with_time msg
-          a = Contrast::Utils::Timer.now_ms
-          ret = yield if block_given?
-          z = Contrast::Utils::Timer.now_ms
-          log_with_level(nil, "#{ msg }: pid=#{ Process.pid }, elapsed=#{ z - a }ms", :debug)
-          ret
-        end
-
-        def log_with_level exception, msg, level, skip_queue: false
-          # Log messages are queued until the logger is initialized.
-          # If agent init fails, flush the log to TARGET.
-          if (lq = @_log_queue) && !skip_queue
-            lq.push [exception, msg, level]
-            return nil
-          end
-
-          if exception&.respond_to?(:message)
-            tmp = msg.nil? ? exception.message.to_s : "#{ exception.class.name }: #{ msg }: #{ exception.message }"
-            logger.send(level, tmp)
-
-            exception.backtrace.first(10).each { |line| logger.debug(line) } if logger.debug? && exception.cs__respond_to?(:backtrace) && exception.backtrace
-          elsif msg.to_s != Contrast::Utils::ObjectShare::EMPTY_STRING
-            logger.send(level, msg.to_s)
-          end
-
-          nil # ensure no return value
-        rescue StandardError
-          nil # NOOP
-        end
-      end
-    end
-  end
-end