contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/components/app_context.rb

@@ -1,8 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/sinatra_helper'
-cs__scoped_require 'rubygems/version'
+require 'rubygems/version'
+require 'contrast/utils/object_share'
+require 'contrast/components/app_context_extend'
+require 'contrast/config/base_configuration'
 
 module Contrast
   module Components
@@ -12,140 +14,165 @@ module Contrast
       # parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Application,
       # including the Client, Process, and Server information.
-      class Interface
+      class Interface # rubocop:disable Metrics/ClassLength
+        include Contrast::Components::AppContextExtend
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-
-        access_component :config
+        include Contrast::Config::BaseConfiguration
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
         DEFAULT_SERVER_NAME = 'localhost'
         DEFAULT_SERVER_PATH = '/'
+        CANON_NAME = 'application'
+        CONFIG_VALUES = %w[name version language path group tags code metadata session_id session_metadata].cs__freeze
+
+        # @return [String]
+        attr_accessor :version
+        # @return [String]
+        attr_accessor :language
+        # @return [String]
+        attr_accessor :group
+        attr_writer :tags
+        # @return [String]
+        attr_accessor :code
+        # @return [String]
+        attr_accessor :metadata
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          original_pid
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @_name = hsh[:name]
+          @version = hsh[:version]
+          @language = hsh[:language]
+          @_path = hsh[:path]
+          @group = hsh[:group]
+          @tags = hsh[:tags]
+          @code = hsh[:code]
+          @metadata = hsh[:metadata]
+          @_session_id = hsh[:session_id]
+          @_session_metadata = hsh[:session_metadata]
+        end
+
+        # @return [String, Contrast::Utils::ObjectShare::EMPTY_STRING]
+        def session_id
+          @_session_id ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        # Set session_id
+        #
+        # @param id [String]
+        # @return [String]
+        def session_id= id
+          @_session_id = id
+        end
+
+        # @return [String, Contrast::Utils::ObjectShare::EMPTY_STRING]
+        def session_metadata
+          @_session_metadata ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
 
-        def present? str
-          Contrast::Utils::EnvironmentUtil.present?(str)
+        # Set session_metadata
+        #
+        # @param meta [String]
+        # @return [String]
+        def session_metadata= meta
+          @_session_metadata = meta
         end
 
         def server_type
           @_server_type ||= begin
-                              tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless present?(tmp)
-                              tmp
-                            rescue StandardError
-                              RACK_TYPE
-                            end
+            tmp = ::Contrast::CONFIG.server.type
+            tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp
+          end
         end
 
         def name
           @_name ||= begin
-                       tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless present?(tmp)
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
-                     rescue StandardError
-                       DEFAULT_APP_NAME
-                     end
+            tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
+          rescue StandardError
+            DEFAULT_APP_NAME
+          end
+        end
+
+        # Set application name
+        #
+        # @param app_name [String] application name
+        # @return [String]
+        def name= app_name
+          @_name = app_name
         end
 
         def path
           @_path ||= begin
-                       tmp = CONFIG.root.application.path
-                       Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
-                     rescue StandardError
-                       DEFAULT_APP_PATH
-                     end
+            tmp = Contrast::Agent.framework_manager.application_root unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_PATH)
+          rescue StandardError
+            DEFAULT_APP_PATH
+          end
         end
 
         def server_name
           @_server_name ||= begin
-                              tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless present?(tmp)
-                              tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
-                            rescue StandardError
-                              DEFAULT_SERVER_NAME
-                            end
+            tmp = ::Contrast::CONFIG.server.name # rubocop:disable Security/Module/Name
+            tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
+            tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
+          rescue StandardError
+            DEFAULT_SERVER_NAME
+          end
         end
 
         def server_path
           @_server_path ||= begin
-                              tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless present?(tmp)
-                              Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
-                            rescue StandardError
-                              DEFAULT_SERVER_PATH
-                            end
+            tmp = ::Contrast::CONFIG.server.path
+            tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
+            Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
+          rescue StandardError
+            DEFAULT_SERVER_PATH
+          end
         end
 
-        def build_app_startup_message
-          msg = Contrast::Api::Dtm::ApplicationCreate.new
-
-          app_ver = if CONFIG.root.application.version.to_s.empty?
-                      Contrast::Utils::EnvironmentUtil.determine_application_version
-                    else
-                      CONFIG.root.application.version
-                    end
-
-          msg.group            = protobuf_format CONFIG.root.application.group
-          msg.tags             = protobuf_format CONFIG.root.application.tags
-          msg.app_version      = protobuf_format app_ver
-          msg.code             = protobuf_format CONFIG.root.application.code
-          msg.metadata         = protobuf_format CONFIG.root.application.metadata
-          # Other fields have limits in TeamServer, the rest don't.
-          msg.session_id       = protobuf_format CONFIG.root.application.session_id,        truncate: false
-          msg.session_metadata = protobuf_format CONFIG.root.application.session_metadata,  truncate: false
-
-          msg
+        def tags
+          stringify_array(@tags)
         end
 
-        LOG_BUILD_STARTUP = 'build startup message'
-        def build_agent_startup_message
-          msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = protobuf_format server_name
-          msg.server_path    = protobuf_format server_path
-          msg.server_type    = protobuf_format server_type
-          msg.server_version = Contrast::Agent::VERSION
-          msg.version        = protobuf_format CONFIG.root.server.version
-          msg.environment    = protobuf_format CONFIG.root.server.environment
-          msg.tags           = protobuf_format CONFIG.root.server.tags
-          msg
+        # Determines if the Process we're currently in matches that of the
+        # Process in which the App Context instance was created.
+        # If it doesn't, that indicates the running context is in a new
+        # Process.
+        # @return [Boolean] if we're in the original Process in which the
+        #   App Context instance was initialized.
+        def in_new_process?
+          current_pid = Process.pid
+          original_pid = pid
+          current_pid != original_pid
         end
 
-        def pid
-          Process.pid
-        end
-
-        def ppid
-          Process.ppid
-        end
-
-        def pgid
-          Process.getpgid(pid)
-        end
-
-        def client_id
-          @_client_id ||= [name, pgid].join('-')
-        end
-
-        # TODO: RUBY-564: This responsibility should be extracted out of app_context and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
-        def instrument_middleware_stack?
-          !Contrast::Utils::JobServersRunning.job_servers_running?
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          super
+          Contrast::CONFIG.server.to_effective_config(effective_config)
         end
 
         private
 
-        # TODO: RUBY-120, move this responsibility toward the protobuf object
-        def protobuf_format param, truncate: true
-          param = param&.to_s
-          param = Contrast::Utils::StringUtils.force_utf8(param)
-          param = Contrast::Utils::StringUtils.truncate(param) if truncate
-          param
+        def original_pid
+          @_original_pid ||= Process.pid
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/app_context_extend.rb

@@ -0,0 +1,53 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    # A wrapper build around the Common Agent Configuration project to allow
+    # for access of the values contained in its
+    # parent_configuration_spec.yaml.
+    # Specifically, this allows for querying the state of the Application,
+    # including the Client, Process, and Server information.
+    module AppContextExtend
+      SUPPORTED_FRAMEWORKS = %w[rails sinatra grape rack].cs__freeze
+      SUPPORTED_SERVERS = %w[passenger puma thin unicorn].cs__freeze
+
+      def pid
+        Process.pid
+      end
+
+      def ppid
+        Process.ppid
+      end
+
+      def app_and_server_information
+        {
+            application_info: find_gem_information(SUPPORTED_FRAMEWORKS),
+            server_info: find_gem_information(SUPPORTED_SERVERS)
+        }
+      end
+
+      def find_gem_information arr
+        arr.each do |framework|
+          next unless Gem.loaded_specs.key?(framework)
+
+          loaded = Gem.loaded_specs[framework]
+          next unless loaded
+
+          name = loaded.instance_variable_get(:@name)
+          version = loaded.instance_variable_get(:@version).to_s
+          return [name, version].join(' ')
+        end
+        nil
+      end
+
+      def instrument_middleware_stack?
+        !Contrast::Utils::JobServersRunning.job_servers_running?
+      end
+
+      def disabled_agent_rake_tasks
+        ::Contrast::CONFIG.agent.ruby.disabled_agent_rake_tasks
+      end
+    end
+  end
+end

data/lib/contrast/components/assess.rb

@@ -1,6 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+require 'contrast/components/config'
+require 'contrast/components/assess_rules'
+
 module Contrast
   module Components
     module Assess
@@ -8,60 +12,242 @@ module Contrast
       # for access of the values contained in its
       # parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Assess product.
-      class Interface
+      class Interface # rubocop:disable Metrics/ClassLength
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
 
-        access_component :settings
+        # @return [Boolean, nil]
+        attr_accessor :enable
+        # @return [Array, nil]
+        attr_writer :enable_scan_response, :enable_dynamic_sources, :sampling, :rules, :stacktraces, :tags
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+        # @return [Boolean]
+        attr_writer :enable_original_object
+        # @return [Integer]
+        attr_writer :max_context_source_events
+        # @return [Integer]
+        attr_writer :max_propagation_events
+        # @return [Integer]
+        attr_writer :max_rule_reported
+        # @return [Integer]
+        attr_writer :time_limit_threshold
+
+        DEFAULT_STACKTRACES = 'ALL'
+        DEFAULT_MAX_SOURCE_EVENTS = 50_000
+        DEFAULT_MAX_PROPAGATION_EVENTS = 50_000
+        DEFAULT_MAX_RULE_REPORTED = 100
+        DEFAULT_MAX_RULE_TIME_THRESHOLD = 300_000
+        CANON_NAME = 'assess'
+        CONFIG_VALUES = %w[
+          enabled?
+          tags
+          enable_scan_response
+          enable_original_object
+          enable_dynamic_sources
+          stacktraces
+          max_context_source_events
+          max_propagation_events
+          max_rule_reported
+          time_limit_threshold
+        ].cs__freeze
+        # rubocop:disable Naming/MemoizedInstanceVariableName
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @enable = hsh[:enable]
+          @tags = hsh[:tags]
+          @enable_scan_response = hsh[:enable_scan_response]
+          @enable_dynamic_sources = hsh[:enable_dynamic_sources]
+          @enable_original_object = hsh[:enable_original_object]
+          @sampling = Contrast::Components::Sampling::Interface.new(hsh[:sampling])
+          @rules = Contrast::Components::AssessRules::Interface.new(hsh[:rules])
+          @stacktraces = hsh[:stacktraces]
+          assign_limits(hsh)
+        end
+
+        # @return [Boolean, true]
+        def enable_scan_response
+          @enable_scan_response.nil? ? true : @enable_scan_response
+        end
+
+        # @return [Boolean, true]
+        def enable_dynamic_sources
+          @enable_dynamic_sources.nil? ? true : @enable_dynamic_sources
+        end
+
+        # @return [Boolean, true]
+        def enable_original_object
+          @enable_original_object.nil? ? true : @enable_original_object
+        end
+
+        # @return [Contrast::Components::Sampling::Interface]
+        def sampling
+          @sampling ||= Contrast::Components::Sampling::Interface.new
+        end
+
+        # @return [Contrast::Components::AssessRules::Interface]
+        def rules
+          @rules ||= Contrast::Components::AssessRules::Interface.new
+        end
+
+        def stacktraces
+          @stacktraces ||= DEFAULT_STACKTRACES
+        end
+
+        def max_rule_reported
+          @max_rule_reported ||= DEFAULT_MAX_RULE_REPORTED
+        end
+
+        def time_limit_threshold
+          @time_limit_threshold ||= DEFAULT_MAX_RULE_TIME_THRESHOLD
+        end
+
+        def max_propagation_events
+          @max_propagation_events ||= DEFAULT_MAX_PROPAGATION_EVENTS
+        end
+
+        def max_context_source_events
+          @max_context_source_events ||= DEFAULT_MAX_SOURCE_EVENTS
+        end
+
+        # @return [String, nil]
+        def tags
+          stringify_array(@tags)
+        end
 
         def enabled?
-          return false unless defined?(Contrast::Agent::FeatureState)
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
 
-          state.assess_enabled?
+          ::Contrast::SETTINGS.assess_state.enabled == true
         end
 
         def tainted_columns
-          SETTINGS.tainted_columns
+          ::Contrast::SETTINGS.tainted_columns
         end
 
         def forcibly_disabled?
-          state.assess_forcibly_disabled?
+          @_forcibly_disabled = false?(enable) if @_forcibly_disabled.nil?
+
+          @_forcibly_disabled
         end
 
         def rule_disabled? name
-          state.assess_rule_disabled? name
+          disabled_rules.include?(name)
         end
 
-        def disabled_rules
-          state.assess_disabled_rules
+        # The value of the stacktrace should be treated as an ENUM. We upcase it for
+        # faster comparisons when we use it. Anything not one of the known values of
+        # 'NONE',  'SOME', or 'ALL' is treated as 'ALL'
+        #
+        # @return [Symbol] the normalized value of ::Contrast::CONFIG.assess.stacktraces
+        def capture_stacktrace_value
+          @_capture_stacktrace_value ||= case stacktraces&.upcase
+                                         when 'NONE'
+                                           :NONE
+                                         when 'SOME'
+                                           :SOME
+                                         else
+                                           :ALL
+                                         end
         end
 
-        def scan_response?
-          state.scan_response?
+        # Consider capture_stacktrace_value along with the node type
+        # to determine whether stacktraces should be captured.
+        #
+        # capture_stacktrace_value -> (:ALL, :NONE, :SOME)
+        # node types (SourceNode, PolicyNode, TriggerNode, PropagationNode)
+        #
+        # @param policy_node [Contrast::Agent::Assess::Policy::PolicyNode] The node in question.
+        # @return [Boolean] to capture or not to capture, that is the question.
+        def capture_stacktrace? policy_node
+          return true if capture_stacktrace_value == :ALL
+          return false if capture_stacktrace_value == :NONE
+
+          # Below here capture_stacktrace_value must be :SOME.
+          return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::SourceNode)
+          return true if policy_node.cs__is_a?(Contrast::Agent::Assess::Policy::TriggerNode)
+
+          false
         end
 
-        def track_frozen_sources?
-          state.assess_track_frozen_sources?
+        def scan_response?
+          @_scan_response = !false?(enable_scan_response) if @_scan_response.nil?
+
+          @_scan_response
         end
 
         def require_scan?
-          state.require_scanning_enabled?
+          @_require_scan = !false?(::Contrast::CONFIG.agent.ruby.require_scan) if @_require_scan.nil?
+          @_require_scan
         end
 
-        def tags
-          state.assess_tags
+        def require_dynamic_sources?
+          return @_require_dynamic_sources unless @_require_dynamic_sources.nil?
+
+          @_require_dynamic_sources = !false?(enable_dynamic_sources)
         end
 
-        def rules
-          SETTINGS.assess_rules
+        def non_request_tracking?
+          @_non_request_tracking = true?(::Contrast::CONFIG.agent.ruby.non_request_tracking) if
+            @_non_request_tracking.nil?
+          @_non_request_tracking
         end
 
-        def rule name
-          SETTINGS.assess_rules[name]
+        def disabled_rules
+          rules&.disabled_rules || ::Contrast::SETTINGS.assess_state.disabled_assess_rules || []
         end
-      end
 
-      COMPONENT_INTERFACE = Interface.new
+        def track_original_object?
+          @_track_original_object = !false?(enable_original_object) if @_track_original_object.nil?
+
+          @_track_original_object
+        end
+
+        # The id for this process, based on the session metadata or id provided by the user, as indicated in
+        # application startup.
+        def session_id
+          ::Contrast::SETTINGS.assess_state.session_id
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          super
+          sampling&.to_effective_config(effective_config)
+          rules&.to_effective_config(effective_config)
+        end
+
+        # rubocop:enable Naming/MemoizedInstanceVariableName
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(::Contrast::CONFIG.assess.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
+
+        # Sets Event limits from configuration and converts string numbers to integers.
+        def assign_limits hsh
+          return unless hsh
+
+          source_limit = hsh[:max_context_source_events]&.to_i
+          propagation_limit = hsh[:max_propagation_events]&.to_i
+          max_rule_reporter = hsh[:max_rule_reported]&.to_i
+          time_limit = hsh[:time_limit_threshold]&.to_i
+
+          @max_context_source_events = source_limit if source_limit
+          @max_propagation_events = propagation_limit if propagation_limit
+          @max_rule_reported = max_rule_reporter if max_rule_reporter
+          @time_limit_threshold = time_limit if time_limit
+        end
+      end
     end
   end
 end

data/lib/contrast/components/assess_rules.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/base_configuration'
+require 'contrast/utils/object_share'
+require 'contrast/components/base'
+
+module Contrast
+  module Components
+    # Common Configuration settings. Those in this section pertain to the
+    # disabled assess rule functionality of the Agent.
+    module AssessRules
+      class Interface # :nodoc:
+        include Contrast::Config::BaseConfiguration
+        include Contrast::Components::ComponentBase
+
+        SPEC_KEY = :disabled_rules.cs__freeze
+        CANON_NAME = 'assess.rules'
+        NAME_PREFIX = "#{ CONTRAST }.#{ CANON_NAME }"
+
+        # @return [Array, nil] list of disabled assess rules
+        attr_accessor :disabled_rules
+        # @return [String]
+        attr_reader :canon_name
+
+        def initialize hsh = {}
+          @canon_name = CANON_NAME
+          @disabled_rules = []
+          return unless hsh
+
+          @disabled_rules = cast_disabled_rules(hsh)
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          add_single_effective_value(effective_config, SPEC_KEY.to_s, disabled_rules, canon_name, NAME_PREFIX)
+        end
+
+        private
+
+        def cast_disabled_rules hsh
+          return unless hsh
+          return unless hsh.key?(SPEC_KEY)
+          return hsh[SPEC_KEY] if hsh[SPEC_KEY].cs__is_a?(Array)
+
+          hsh[SPEC_KEY].split(',').map(&:strip) if hsh[SPEC_KEY].cs__is_a?(String)
+        end
+      end
+    end
+  end
+end