contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/inventory/policy/policy.rb

@@ -1,11 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
-cs__scoped_require 'contrast/agent/patching/policy/policy'
+require 'contrast/agent/inventory/policy/trigger_node'
+require 'contrast/agent/patching/policy/policy'
 
 # classes required by patches in the policy
-cs__scoped_require 'contrast/extensions/ruby_core/inventory/datastores'
+require 'contrast/agent/inventory/policy/datastores'
 
 module Contrast
   module Agent
@@ -19,7 +19,7 @@ module Contrast
           end
 
           def disabled_globally?
-            !INVENTORY.enabled?
+            !::Contrast::INVENTORY.enable
           end
 
           def node_type

data/lib/contrast/agent/inventory/policy/trigger_node.rb

@@ -1,7 +1,7 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/patching/policy/trigger_node'
+require 'contrast/agent/patching/policy/trigger_node'
 
 module Contrast
   module Agent

data/lib/contrast/agent/middleware/middleware.rb

@@ -0,0 +1,214 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'ipaddr'
+require 'json'
+require 'rack'
+
+require 'contrast/security_exception'
+require 'contrast/utils/object_share'
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/utils/heap_dump_util'
+require 'contrast/agent/telemetry/telemetry'
+require 'contrast/agent/request/request_handler'
+require 'contrast/agent/middleware/static_analysis'
+require 'contrast/agent/telemetry/startup_metrics_event'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/utils/middleware_utils'
+require 'contrast/utils/reporting/application_activity_batch_utils'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    # This class allows the Agent to plug into the Rack middleware stack. When the application is first started, we
+    # initialize ourselves as a rack middleware inside of #initialize. Afterwards, we process each http request and
+    # response as it goes through the middleware stack inside of #call.
+    class Middleware # rubocop:disable Metrics/ClassLength
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Components::Scope::InstanceMethods
+      include Contrast::Utils::MiddlewareUtils
+      include Contrast::Utils::Reporting::ApplicationActivityBatchUtils
+
+      attr_reader :app
+
+      # Allows the Agent to function as a middleware. We perform all our one-time whole-app routines in here since
+      # we're only going to be initialized a single time. Our initialization order is:
+      # - capture the application
+      # - setup the Agent
+      # - startup the Agent
+      #
+      # @param app [Rack::Application] the application to be instrumented
+      # @param _legacy_param [nil] was a flag we no longer need, but Sinatra may call it
+      def initialize app, _legacy_param = nil
+        @app = app  # THIS MUST BE FIRST AND ALWAYS SET!
+        setup_agent # THIS MUST BE SECOND AND ALWAYS CALLED!
+        unless ::Contrast::AGENT.enabled?
+          logger.error('The Agent was unable to initialize before the application middleware was initialized. ' \
+                       'Disabling permanently.')
+          ::Contrast::AGENT.disable! # ensure the agent is disabled (probably redundant)
+          return
+        end
+        agent_startup_routine
+      rescue StandardError => e
+        logger.error('Unable to initialize the agent. Disabling permanently.', e)
+        ::Contrast::AGENT.disable! # ensure the agent is disabled (probably redundant)
+      end
+
+      # This is where we're hooked into the middleware stack. If the agent is enabled, we're ready to do some
+      # processing on a per request basis. If not, we just pass the request along to the next middleware in the stack.
+      # If Application Scope feature is enabled we execute the env call with that scope, enabling only analysis for
+      # the current application, and nothing outside that.
+      #
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
+      #   the Rack framework.
+      def call env
+        return with_app_scope { call_routine(env) } if Contrast::RUBY_INTERFACE.start_with_application_scope?
+
+        call_routine(env)
+      end
+
+      private
+
+      # This is the call routine we do when we are hooked to the middleware stack.
+      #
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user up
+      #   the Rack framework.
+      def call_routine env
+        logger.trace_with_time('Elapsed time for Contrast::Agent::Middleware#call') do
+          return app.call(env) unless ::Contrast::AGENT.enabled?
+
+          Contrast::Agent.heapdump_util.start_thread!
+          handle_first_request
+          call_with_agent(env)
+        end
+      end
+
+      # Startup the Agent as part of the initialization process:
+      # - start the TeamServer sending thread, responsible for sending and processing messages
+      # - start the heartbeat thread, which handles periodic messages to TeamServer
+      # - start instrumenting libraries and do a 'catchup' patch for everything we didn't see get loaded
+      # - enable TracePoint, which handles all class loads and required instrumentation going forward
+      def agent_startup_routine
+        logger.debug_with_time('middleware: starting reporting threads') do
+          Contrast::Agent.thread_watcher.ensure_running?
+        end
+
+        if Contrast::Agent::Telemetry::Base.enabled?
+          logger.debug_with_time('middleware: sending startup metrics telemetry event') do
+            event = Contrast::Agent::Telemetry::StartupMetricsEvent.new
+            Contrast::Agent.thread_watcher.telemetry_queue.send_event(event)
+          end
+        end
+
+        logger.debug_with_time('middleware: instrument shared libraries and patch') do
+          Contrast::Agent::Patching::Policy::Patcher.patch
+        end
+
+        logger.debug_with_time('middleware: enabling tracepoint') do
+          ::Contrast::AGENT.enable_tracepoint
+        end
+        Contrast::Agent::AtExitHook.exit_hook
+      end
+
+      # Some things have to wait until first request to happen, either because resolution is not complete or because
+      # the framework will preload classes, which confuses some of our instrumentation.
+      def handle_first_request
+        @_handle_first_request ||= begin
+          Contrast::Agent::StaticAnalysis.catchup
+          true
+        end
+      end
+
+      # This is where we process each request we intercept as a middleware. We make the request context available
+      # globally so that it can be accessed from anywhere. A RequestHandler object is made for each request, which
+      # handles prefilter and postfilter operations.
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @return [Array,Rack::Response] the Response of this and subsequent Middlewares to be passed back to the user
+      #   up the Rack framework.
+      def call_with_agent env
+        Contrast::Agent.thread_watcher.ensure_running?
+        framework_request = Contrast::Agent.framework_manager.retrieve_request(env)
+        context = Contrast::Agent::RequestContext.new(framework_request)
+        response = nil
+
+        # Make the context available for the lifecycle of this request.
+        Contrast::Agent::REQUEST_TRACKER.lifespan(context) do
+          logger.request_start
+          request_handler = Contrast::Agent::RequestHandler.new(context)
+
+          pre_call_with_agent(context, request_handler)
+          response = application_code(env)
+          post_call_with_agent(context, env, request_handler, response)
+        ensure
+          logger.request_end
+        end
+
+        response
+      rescue StandardError => e
+        handle_exception(e)
+      end
+
+      # Handle the operations the Agent needs to accomplish prior to the Application code executing during this
+      # request.
+      #
+      # @param context [Contrast::Agent::RequestContext]
+      # @param request_handler [Contrast::Agent::RequestHandler]
+      # @raise [StandardError] raises an error if the exception is security concern
+      #    which is being triggered when there is a failure within the pre-call with the agent
+      def pre_call_with_agent context, request_handler
+        with_contrast_scope do
+          context.protect_input_analysis
+          request_handler.ruleset.prefilter
+        end
+      rescue StandardError => e
+        raise(e) if security_exception?(e)
+
+        logger.error('Unable to execute agent pre_call', e)
+      end
+
+      # Handle the operations the Agent needs to accomplish after the Application code executes during this request.
+      #
+      # @param context [Contrast::Agent::RequestContext]
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this Request
+      # @param request_handler [Contrast::Agent::RequestHandler]
+      # @param response [Array,Rack::Response]
+      # @raise [StandardError] raises an error if the exception is security concern
+      #    which is being triggered when there is a failure within the post-call with the agent
+      def post_call_with_agent context, env, request_handler, response
+        with_contrast_scope do
+          context.extract_after(response) # update context with final response information
+
+          Contrast::Agent::FINDINGS.report_collected_findings unless Contrast::Agent::FINDINGS.collection.empty?
+          # All protect rules, which are trigger but require response to be reported
+          Contrast::Agent::EXPLOITS.report_recorded_exploits(context) unless Contrast::Agent::EXPLOITS.collection.empty?
+          # Now we can build the ia_results only for postfilter rules.
+          context.protect_postfilter_ia
+          # Process Worth Watching Inputs for v2 rules
+          Contrast::Agent.worth_watching_analyzer&.add_to_queue(context.agent_input_analysis)
+
+          if Contrast::Agent.framework_manager.streaming?(env)
+            context.reset_activity
+            request_handler.stream_safe_postfilter
+          else
+            request_handler.ruleset.postfilter
+            request_handler.report_observed_route
+            add_activity_to_batch(context.activity)
+            report_batch
+          end
+        end
+      # unsuccessful attack
+      rescue StandardError => e
+        raise(e) if security_exception?(e)
+
+        logger.error('Unable to execute agent post_call', e)
+      end
+    end
+  end
+end

data/lib/contrast/agent/middleware/static_analysis.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/agent/reporting/reporting_events/application_update'
+
+module Contrast
+  module Agent
+    # this module handles one time static analysis tasks
+    class StaticAnalysis
+      include Singleton
+      include Contrast::Components::Scope::InstanceMethods
+      extend Contrast::Components::Logger::InstanceMethods
+
+      class << self
+        # After the first request is complete, we do a one-time manual catchup to review and report the already-loaded
+        # gems.
+        def catchup
+          @_catchup ||= begin
+            threaded_analysis!
+            true
+          end
+        end
+
+        def send_inventory_message
+          return unless ::Contrast::INVENTORY.enable
+
+          report = Contrast::Agent::Reporting::ApplicationUpdate.new
+          # This convert here is left as it'll be easier to be replaced when the Library is being changed
+          report.libraries = Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list
+          Contrast::Agent::Inventory::DatabaseConfig.append_db_config(report)
+          [report, Contrast::Agent::Reporting::ApplicationInventory.new].each do |e|
+            Contrast::Agent.reporter.send_event(e)
+          end
+        end
+
+        private
+
+        def threaded_analysis!
+          Contrast::Agent::Thread.new do
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.catchup
+            send_inventory_message
+          rescue StandardError => e
+            logger.warn('Unable to run post-initialization static analysis', e)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -1,7 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/components/scope'
+require 'contrast/extension/module'
+require 'contrast/utils/class_util'
 
 module Contrast
   module Agent
@@ -9,16 +11,20 @@ module Contrast
       module Policy
         # Used to handle tracking patches that need to apply special instrumentation when a module is loaded
         class AfterLoadPatch
-          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument
-          def initialize module_name, instrumentation_file_path, method_to_instrument: nil
+          include Contrast::Components::Scope::InstanceMethods
+
+          attr_reader :applied, :module_name, :instrumentation_file_path, :method_to_instrument, :instrumenting_module
+
+          def initialize module_name, instrumentation_file_path, method_to_instrument: nil, instrumenting_module: nil
             @applied = false
             @module_name = module_name
             @method_to_instrument = method_to_instrument
             @instrumentation_file_path = instrumentation_file_path
+            @instrumenting_module = instrumenting_module
           end
 
           def applied?
-            @applied
+            applied
           end
 
           # Modules can be re-opened, so the first load may not
@@ -41,7 +47,7 @@ module Contrast
             return true  unless target_defined? # bc no methods are loaded
             return false unless method_to_instrument
 
-            !module_lookup.instance_methods.include? method_to_instrument
+            !module_lookup.instance_methods.include?(method_to_instrument)
           end
 
           def applies? loaded_module_name
@@ -53,7 +59,12 @@ module Contrast
           end
 
           def instrument!
-            cs__scoped_require instrumentation_file_path
+            require(instrumentation_file_path)
+
+            if instrumenting_module
+              mod = Module.cs__const_get(instrumenting_module)
+              with_contrast_scope { mod.instrument } if mod
+            end
             @applied = true
           end
 
@@ -61,10 +72,10 @@ module Contrast
 
           def module_lookup
             @_module_lookup ||= begin
-                                  Module.cs__const_get module_name
-                                rescue StandardError => _e
-                                  nil
-                                end
+              Module.cs__const_get(module_name)
+            rescue StandardError => _e
+              nil
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -1,8 +1,12 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/agent/patching/policy/after_load_patch'
+require 'contrast/components/logger'
+require 'contrast/framework/manager'
+require 'contrast/extension/extension'
+require 'contrast/extension/assess/kernel'
+require 'contrast/extension/assess/marshal'
 
 module Contrast
   module Agent
@@ -11,70 +15,117 @@ module Contrast
         # Some modules diverge from our generic instrumentation and require custom instrumentation
         # after they've been loaded
         module AfterLoadPatcher
-          include Contrast::Components::Interface
-          access_component :logging, :agent
-
-          AFTER_LOAD_PATCHES = Set.new([
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_time_zone_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Railties::Helper::ClassMethods',
-                                             'contrast/extensions/framework/rails/action_controller_railties_helper_inherited',
-                                             method_to_instrument: :inherited),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::Scoping::Named::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record_named'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActiveRecord::AttributeMethods::Read::ClassMethods',
-                                             'contrast/extensions/framework/rails/active_record'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Sinatra::Base',
-                                             'contrast/extensions/framework/sinatra/base'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rails::Application::Configuration',
-                                             'contrast/extensions/framework/rails/configuration',
-                                             method_to_instrument: :session_store),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Request',
-                                             'contrast/extensions/framework/rack/request'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Response',
-                                             'contrast/extensions/framework/rack/response'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'ActionController::Live::Buffer',
-                                             'contrast/extensions/framework/rails/buffer'),
-                                         Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
-                                             'Rack::Session::Cookie',
-                                             'contrast/extensions/framework/rack/cookie')
-                                       ])
+          include Contrast::Components::Logger::InstanceMethods
 
           # After initialization run a catchup check to instrument any already loaded modules we care about
           def catchup_after_load_patches
-            applied = []
-            AFTER_LOAD_PATCHES.each do |after_load_patch|
+            apply_require_patches!
+            apply_direct_patches!
+            apply_load_patches!
+          end
+
+          private
+
+          # These patches need to be applied directly, not from our policy, so
+          # do so and do so only once. This should be the new standard so that
+          # there are no require time side effects of loading our core
+          # extensions.
+          def apply_direct_patches!
+            @_apply_direct_patches ||= begin
+              paths = %w[
+                array
+                basic_object
+                module
+                fiber_track
+                hash
+                kernel
+                marshal_module
+                regexp
+                string
+                string_interpolation
+              ].cs__freeze
+              paths.each do |p|
+                path_part = "cs__assess_#{ p }"
+                Contrast::Extension::Assess::InstrumentHelper.instrument("#{ path_part }/#{ path_part }")
+              end
+              # apply Kernel#exec alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Kernel, :exec, false)
+                apply_kernel_exec_alias_patch
+              end
+              # apply Marshal load alias patch:
+              unless Contrast::Agent::Assess.cs__object_method_prepended?(Marshal, :load, false)
+                apply_marshal_load_alias_patch
+              end
+              apply_array_join_prepend_patch if Contrast::Agent::Assess.cs__object_method_prepended?(Array, :join, true)
+              true
+            end
+          end
+
+          def apply_load_patches!
+            after_load_patches.each do |after_load_patch|
               next unless after_load_patch.target_defined?
-              next if AGENT.skip_instrumentation?(after_load_patch.module_name)
+              next if ::Contrast::AGENT.skip_instrumentation?(after_load_patch.module_name)
 
-              logger.debug("Detected loading of #{ after_load_patch.module_name } - applying instrumentation")
+              logger.trace('Catching up on already loaded afterload patch - applying instrumentation',
+                           module: after_load_patch.module_name)
               after_load_patch.instrument!
-              applied << after_load_patch
+            rescue NameError => e
+              logger.error('Method undefined in afterload patch', e, module: after_load_patch.module_name,
+                                                                     method: after_load_patch.method_to_instrument)
+            rescue StandardError => e
+              logger.error('Afterload patch failed to apply', e, module: after_load_patch.module_name,
+                                                                 method: after_load_patch.method_to_instrument)
+            end
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # These patches need to be applied directly, not from our policy, and
+          # are applied as a result of requiring the file as they alias methods
+          # directly, allowing us to control things like scope and exception
+          # handling
+          def apply_require_patches!
+            @_apply_require_patches ||= begin
+              require('contrast/extension/thread')
+              true
+            rescue LoadError, StandardError => e
+              logger.error('failed instrumenting apply_require_patches!', e)
+              false
             end
-            AFTER_LOAD_PATCHES.subtract(applied)
+          end
+
+          def after_load_patches
+            @_after_load_patches ||= Contrast::Agent.framework_manager.find_after_load_patches
           end
 
           # Use for any checks after we've initialized
           def load_patches_for_module module_name
-            return if AFTER_LOAD_PATCHES.empty?
+            return if after_load_patches.empty?
 
-            patch = AFTER_LOAD_PATCHES.find { |after_load_patch| after_load_patch.applies?(module_name) }
+            patch = after_load_patches.find { |after_load_patch| after_load_patch.applies?(module_name) }
             return unless patch
 
-            logger.debug("Detected loading of #{ module_name } - applying instrumentation")
-
+            logger.trace('Detected loading of afterload patch - applying instrumentation', module: module_name)
             patch.instrument!
-            AFTER_LOAD_PATCHES.subtract([patch]) if patch.applied?
+            after_load_patches.delete_if(&:applied?)
+          end
+
+          # Applies the Kernel#exec alias patch
+          def apply_kernel_exec_alias_patch
+            Kernel.extend(Contrast::Extension::Assess::ContrastKernel)
+            Marshal.alias_method(:cs__kernel_exec, :exec)
+            Marshal.alias_method(:exec, :cs__kernel_exec)
+          end
+
+          # Applies the Marshal#load alias patch
+          def apply_marshal_load_alias_patch
+            Marshal.extend(Contrast::Extension::Assess::ContrastMarshal)
+            Marshal.alias_method(:cs__marshal_load, :load)
+            Marshal.alias_method(:load, :cs__marshal_load)
+          end
+
+          # Prepend Contrast::Extension::Assess::ContrastArray to pick up the ContrastArray#join method
+          def apply_array_join_prepend_patch
+            Array.prepend(Contrast::Extension::Assess::ContrastArray)
           end
         end
       end