contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent_lib/interface_base.rb

@@ -0,0 +1,131 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast-agent-lib'
+require 'contrast/agent/reporting/settings/helpers'
+
+module Contrast
+  module AgentLib
+    # Base class to set basic rule sets and input list.
+    class InterfaceBase
+      LOG_LEVEL = { -1 => 'OFF', 0 => 'TRACE', 1 => 'DEBUG', 2 => 'INFO', 3 => 'WARN', 4 => 'ERROR' }.cs__freeze
+      LOG_DIR = File.join(Dir.pwd).cs__freeze
+      # Parameters passed to AgentLib. WorthWatching is used for those rules only that support it.
+
+      # Initializes the Agent lib.
+      #
+      # @param enable_logging [Boolean, nil] flag to enable or disable logging.
+      # @param set_log_level [Integer, nil]
+      # @param set_log_dir [String, nil] dir to write log files.
+      # @return [Boolean] true if success.
+      # @raise [StandardError] Any Errors raised in the init process are most
+      # likely to be a C segfaults and termination, probably redundant but safe.
+      def initialize enable_logging = nil, set_log_level = nil, set_log_dir = nil
+        # Override
+      end
+
+      # Return list of available rules. On first call the constants are extracted from the gem and set
+      # to resemble the protect rules ids used across the agent, e.g. CMD_INJECTIONS => cmd-injection.
+      #
+      # *** Note that the NoSQLI rules is used within the agent, but in future need arise to be used with the
+      # AgentLib, the rule_id for that rule atm is 'nosql-injection-mongo' ***
+      #
+      # All the rules types extracted from the AgentLib gem will have value corresponding to an ulong enum in
+      # Rust land.
+      # @return [Hash]
+      # @raise [NameError] If Gem is loaded but not constants are generated there could be not defined
+      # module name, or if module was renamed.
+      def rule_set
+        @_rule_set ||= extract_constants(ContrastAgentLib::RuleType, to_rule_id: true)
+      end
+
+      # Returns list of available input types
+      #
+      # @return [Hash]
+      def input_set
+        @_input_set ||= extract_constants(ContrastAgentLib::InputType)
+      end
+
+      # Return the AgentLib supported Database types.
+      #
+      # @return [Hash]
+      def db_set
+        @_db_set ||= extract_constants(ContrastAgentLib::DbType)
+      end
+
+      # Return list of input evaluation options:
+      # WorthWatching or none
+      #
+      # @return [Hash]
+      def eval_option
+        @_eval_option ||= begin
+          consts = extract_constants(ContrastAgentLib::EvalOptions).dup
+          # Adding the option to call the AgentLib without WorthWatching:
+          consts[:NONE] = 0
+          consts.cs__freeze
+        end
+      end
+
+      private
+
+      # Updates the logging status:
+      # Enabled && Level
+      #
+      # @param level [Integer] one of:
+      # [-1...4]
+      # @param enabled [Boolean] logging status.
+      def update_logging level, enabled
+        update_log_level(level)
+        @enable_log = !!enabled
+      end
+
+      # Updates the log level for the AgentLib.
+      #
+      # @param level [Integer] one of:
+      # [-1...4]
+      def update_log_level level
+        value = LOG_LEVEL[level]
+        @log_level = value if value
+      end
+
+      # Creates the directory for AgentLib log files.
+      # If no path provided use default.
+      #
+      # @param log_dir [String, nil] path to log.
+      # @rescue [StandardError] any error concerning
+      # the directory creation.
+      def create_log_dir log_dir = nil
+        path = log_dir.nil? ? LOG_DIR : log_dir
+        FileUtils.mkdir_p(path)
+        path
+      rescue StandardError => e
+        logger.debug('Could not create log directory', error: e)
+        FileUtils.mkdir_p(LOG_DIR)
+        LOG_DIR
+      end
+
+      # This method extracts constants from the AgentLib gem, from specific module.
+      # If the to_rule_id flag is set the constant names would be transformed from
+      # Symbols to string protect rule ids: e.g. CMD_INJECTIONS => cmd-injection.
+      #
+      # @param module_name [Module] e.g. ContrastAgentLib::RuleType
+      # @param to_rule_id [Boolean] Flag to convert the keys of the hash to protect rule_id style
+      # @return [Hash] Frozen hash with the extracted constants
+      def extract_constants module_name, to_rule_id: false
+        hash = {}
+        return hash unless module_name.cs__is_a?(Module)
+
+        module_name.cs__constants.each do |constant|
+          key = to_rule_id ? Contrast::Agent::Reporting::Settings::Helpers.to_rule_id(constant) : constant
+          hash[key] = module_name.cs__const_get(constant)
+        end
+        hash.cs__freeze
+      rescue NameError => e
+        # This should be log as error since if there is no rule set there will be no ia happening,
+        # and something has gone wrong with enabling the gem for the Agent.
+        logger.error("[AgentLib] Could not extract #{ module_name } constants", error: e)
+        {}.cs__freeze
+      end
+    end
+  end
+end

data/lib/contrast/agent_lib/return_types/eval_result.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent_lib/interface'
+
+module Contrast
+  module AgentLib
+    # This class will hold resulst received form AgentLib structs.
+    class EvalResult
+      # Name of the Protect rule analyzed.
+      # @return [String]
+      attr_accessor :rule_id
+      # Type of the input.
+      # @return [String]
+      attr_accessor :input_type
+      # Score of the input after AgentLib
+      # Analysis
+      #
+      # @return score [Float]
+      attr_accessor :score
+
+      # Init a new EvalResult, and translate results to usable for
+      # reporting values.
+      #
+      # @param hsh [Hash, nil] return from AgentLib populated struct.
+      def initialize hsh
+        return unless hsh&.cs__is_a?(Hash)
+
+        @rule_id = Contrast::AGENT_LIB.rule_set.key(hsh[:rule_id])
+        @input_type = Contrast::AGENT_LIB.input_set.key(hsh[:input_type])
+        @score = hsh[:score]
+      end
+
+      # Used in specs.
+      def to_controlled_hash
+        {
+            rule_id: rule_id,
+            input_type: input_type,
+            score: score
+        }
+      end
+    end
+  end
+end

data/lib/contrast/agent_lib/test.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: false
+
+require_relative 'api/init'
+
+module Contrast # :nodoc:
+  module Test # :nodoc:
+    extend Contrast::AgentLib::Init
+
+    LOG_DIR = File.join(File.dirname(__FILE__))
+
+    class << self
+      def test_init_with_options enable_log, log_level
+        dl__init_with_options(enable_log, LOG_DIR, log_level)
+      end
+    end
+  end
+end
+
+# for the other cases - I tried with loop and everything, but nothing worked
+# Contrast::Test.test_init_with_options(true, "WARN")
+# Contrast::Test.test_init_with_options(true, "ERROR")
+# Contrast::Test.test_init_with_options(true, "DEBUG")
+# Contrast::Test.test_init_with_options(true, "TRACE")
+response = Contrast::Test.test_init_with_options(true, 'INFO')
+puts response # rubocop:disable Rails/Output
+
+# we cannot check here for the file as it's being created after the execution of the file is done
+raise(StandardError, 'Not Working') if response == false

data/lib/contrast/components/agent.rb

@@ -1,23 +1,80 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'rubygems/version'
+require 'rubygems/version'
+require 'contrast/components/base'
+require 'contrast/components/rule_set'
+require 'contrast/components/logger'
+require 'contrast/components/security_logger'
+require 'contrast/components/heap_dump'
+require 'contrast/components/ruby_component'
+require 'contrast/components/polling'
+require 'contrast/agent/hooks/tracepoint_hook'
 
 module Contrast
   module Components
     module Agent
       # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
+      # for access of the values contained in its parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
 
-        access_component :config
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+        # @return [Boolean]
+        attr_accessor :enable
+
+        CANON_NAME = 'agent'
+        CONFIG_VALUES = %w[enabled? omit_body?].cs__freeze
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @_enable = hsh[:enable]
+          @_omit_body = hsh[:omit_body]
+          @_polling = Contrast::Components::Polling::Interface.new(hsh[:polling])
+          @_logger = Contrast::Components::Logger::Interface.new(hsh[:logger])
+          @_security_logger = Contrast::Components::SecurityLogger::Interface.new(hsh[:security_logger])
+          @_ruby = Contrast::Components::Ruby::Interface.new(hsh[:ruby])
+          @_heap_dump = Contrast::Components::HeapDump::Interface.new(hsh[:heap_dump])
+        end
+
+        def logger
+          return @_logger unless @_logger.nil?
+
+          @_logger = Contrast::Components::Logger::Interface.new
+        end
+
+        def polling
+          @_polling ||= Contrast::Components::Polling::Interface.new
+        end
+
+        def security_logger
+          return @_security_logger unless @_security_logger.nil?
+
+          @_security_logger = Contrast::Components::SecurityLogger::Interface.new
+        end
+
+        def ruby
+          return @_ruby unless @_ruby.nil?
+
+          @_ruby = Contrast::Components::Ruby::Interface.new
+        end
+
+        def heap_dump
+          return @_heap_dump unless @_heap_dump.nil?
+
+          @_heap_dump = Contrast::Components::HeapDump::Interface.new
+        end
 
         def enabled?
-          !!@enabled
+          @_enable = !false?(::Contrast::CONFIG.enable) if @_enable.nil?
+          @_enable
         end
 
         def disabled?
@@ -25,80 +82,79 @@ module Contrast
         end
 
         def enable!
-          @enabled = true
+          @_enable = true
         end
 
         def disable!
-          @enabled = false
+          @_enable = false
+          Contrast::Agent::TracePointHook.disable
+          Contrast::Agent.thread_watcher&.shutdown!
         end
 
-        def unavailable?
-          !enabled?
+        def ruleset
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_protect_ruleset.values)
         end
 
-        def ready?
-          state.agent_ready?
+        def reset_ruleset
+          @_ruleset = nil
         end
 
-        def patch_interpolation?
-          interpolation_patch_possible?
-        end
-
-        def rewrite_interpolation?
-          !interpolation_patch_possible?
+        def patch_yield?
+          !false?(ruby.propagate_yield)
         end
 
-        def patch_yield?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield)
+        def omit_body?
+          @_omit_body
         end
 
-        def interpolation_enabled?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate)
+        def disable_agent!
+          @_enable = false
         end
 
-        def report_custom_code_sysfile_access?
-          Contrast::Agent::FeatureState.instance.report_custom_code_sysfile_access?
+        def exception_control
+          @_exception_control ||= {
+              enable: true?(ruby.exceptions.capture),
+              status: ruby.exceptions.override_status || 403,
+              message: ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+          }
         end
 
         def skip_instrumentation? loaded_module_name
           return true unless loaded_module_name
 
-          loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
-        end
-
-        # All this method chain does anymore is load the Thread patch that
-        # propagates request contexts.  That can go away RUBY-700.
-        SHARED_LIBRARIES = %w[contrast/extensions/ruby_core/thread].cs__freeze
-        def run_instrumentation
-          Contrast::Agent::FeatureState.instance.tap do |settings|
-            SHARED_LIBRARIES.each { |lib| settings.instrument lib }
-          end
-          Contrast::Agent::Patching::Policy::Patcher.patch # This acts as a catch up for everything we didn't see get loaded
-          enable_tracepoint # This handles all class loads & required instrumentation going forward
+          loaded_module_name.start_with?(*::Contrast::CONFIG.agent.ruby.uninstrument_namespace)
         end
 
-        # TODO: RUBY-564: This responsibility should be extracted out of this agent component and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
+        # Insert ourselves into the application, keeping our middleware at the outermost layer of the onion
         def insert_middleware app
-          app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
+          app.middleware.insert_before(0, Contrast::Agent::Middleware)
         end
 
         def enable_tracepoint
           Contrast::Agent::TracePointHook.enable!
         end
 
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          super
+          logger&.to_effective_config(effective_config)
+          security_logger&.to_effective_config(effective_config)
+          ruby&.to_effective_config(effective_config)
+          heap_dump&.to_effective_config(effective_config)
+          polling&.to_effective_config(effective_config)
+        end
+
         protected
 
-        INTERPOLATION_HOOKABLE_VERSION = Gem::Version.new('2.6.0')
-        # Ruby exposed the C method for interpolation in version 2.6.0, meaning
-        # we can attempt to patch using Funchook for that version and later.
-        def interpolation_patch_possible?
-          @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
-          @_interpolation_patch_possible
+        def retrieve_protect_ruleset
+          return {} unless enabled? && ::Contrast::PROTECT.enabled?
+
+          ::Contrast::PROTECT.defend_rules
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/api.rb

@@ -0,0 +1,159 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+require 'contrast/components/config'
+require 'contrast/config/api_proxy_configuration'
+require 'contrast/config/request_audit_configuration'
+require 'contrast/config/certification_configuration'
+
+module Contrast
+  module Components
+    module Api
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for Api keys to be mapped with their values contained in their
+      # parent_configuration_spec.yaml.
+      class Interface
+        include Contrast::Components::ComponentBase
+        include Contrast::Config::BaseConfiguration
+
+        CANON_NAME = 'api'
+        PROXY_NAME = "#{ CANON_NAME }.proxy"
+        CONFIG_VALUES = %w[api_key user_name service_key url].cs__freeze
+
+        # @return [String]
+        attr_accessor :api_key
+        # @return [String]
+        attr_accessor :user_name
+        # @return [String]
+        attr_accessor :service_key
+        attr_writer :url
+
+        DEFAULT_URL = 'https://app.contrastsecurity.com/Contrast'
+
+        def initialize hsh = {}
+          return unless hsh
+
+          @api_key = hsh[:api_key]
+          @url = hsh[:url]
+          @user_name = hsh[:user_name]
+          @service_key = hsh[:service_key]
+          @_proxy = Contrast::Config::ApiProxyConfiguration.new(hsh[:proxy])
+          @_request_audit = Contrast::Config::RequestAuditConfiguration.new(hsh[:request_audit])
+          @_certificate = Contrast::Config::CertificationConfiguration.new(hsh[:certificate])
+        end
+
+        def url
+          @url.nil? ? DEFAULT_URL : @url
+        end
+
+        # @return [Contrast::Config::ApiProxyConfiguration]
+        def proxy
+          return @_proxy unless @_proxy.nil?
+
+          @_proxy = Contrast::Config::ApiProxyConfiguration.new
+        end
+
+        # @return [Contrast::Config::RequestAuditConfiguration]
+        def request_audit
+          return @_request_audit unless @_request_audit.nil?
+
+          @_request_audit = Contrast::Config::RequestAuditConfiguration.new
+        end
+
+        # @return [Contrast::Config::CertificationConfiguration]
+        def certificate
+          return @_certificate unless @_certificate.nil?
+
+          @_certificate = Contrast::Config::CertificationConfiguration.new
+        end
+
+        def api_url
+          @_api_url ||= begin
+            tmp = Contrast::CONFIG.api.url
+            tmp += '/Contrast' unless tmp.end_with?('/Contrast')
+            tmp
+          end
+        end
+
+        def proxy_enable
+          return @_proxy_enable unless @_proxy_enable.nil?
+
+          @_proxy_enable = true?(::Contrast::CONFIG.api.proxy.enable)
+        end
+
+        def proxy_url
+          proxy.url
+        end
+
+        def request_audit_enable
+          return @_request_audit_enable unless @_request_audit_enable.nil?
+
+          @_request_audit_enable = true?(::Contrast::CONFIG.api.request_audit.enable)
+        end
+
+        def request_audit_requests
+          return @_request_audit_requests unless @_request_audit_requests.nil?
+
+          @_request_audit_requests = true?(::Contrast::CONFIG.api.request_audit.requests)
+        end
+
+        def request_audit_responses
+          return @_request_audit_responses unless @_request_audit_responses.nil?
+
+          @_request_audit_responses = true?(::Contrast::CONFIG.api.request_audit.responses)
+        end
+
+        def request_audit_path
+          @_request_audit_path ||= ::Contrast::CONFIG.api.request_audit.path.to_s
+        end
+
+        def certification_enable
+          @_certification_enable ||= certification_truly_enabled?(::Contrast::CONFIG.api.certificate)
+        end
+
+        def certification_ca_file
+          @_certification_ca_file ||= ::Contrast::CONFIG.api.certificate.ca_file
+        end
+
+        def certification_cert_file
+          @_certification_cert_file ||= ::Contrast::CONFIG.api.certificate.cert_file
+        end
+
+        def certification_key_file
+          @_certification_key_file ||= ::Contrast::CONFIG.api.certificate.key_file
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          add_effective_config_values(effective_config, CONFIG_VALUES, CANON_NAME, CONTRAST)
+          effective_proxy(effective_config)
+          request_audit&.to_effective_config(effective_config)
+          certificate&.to_effective_config(effective_config)
+        end
+
+        private
+
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def effective_proxy effective_config
+          add_single_effective_value(effective_config, ENABLE, proxy_enable.to_s, PROXY_NAME, "#{ CONTRAST }.proxy")
+          return unless proxy_url && proxy_enable
+
+          add_single_effective_value(effective_config, 'url', proxy_url, PROXY_NAME, "#{ CONTRAST }.proxy")
+        end
+
+        def certification_truly_enabled? config_path
+          return false unless true?(config_path.enable)
+          return true if file_exists?(certification_ca_file) && valid_cert?(certification_ca_file)
+          return true if file_exists?(certification_cert_file) && valid_cert?(certification_cert_file)
+          return true if file_exists?(certification_key_file) && valid_cert?(certification_key_file)
+
+          false
+        end
+      end
+    end
+  end
+end