contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/components/base.rb

@@ -0,0 +1,103 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/config/diagnostics_tools'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Components
+    # All components should inherit from this,
+    # whether Interfaces, InstanceMethods or ClassMethods.
+    module ComponentBase
+      include Contrast::Agent::DiagnosticsConfig::DiagnosticsTools
+
+      CONTRAST = 'contrast'
+      ENABLE = 'enable'
+
+      # Used for config diagnostics. Override per rule.
+      #
+      # @return [String]
+      def canon_name
+        Contrast::Utils::ObjectShare::EMPTY_STRING
+      end
+
+      # Used for config diagnostics. Override per rule.
+      #
+      # @return [Array]
+      def config_values
+        Contrast::Utils::ObjectShare::EMPTY_ARRAY
+      end
+
+      # use this to determine if the configuration value is literally boolean
+      # false or some form of the word `false`, regardless of case. It should
+      # be used for those values which default to `true` as they should only
+      # treat a value explicitly set to `false` as such.
+      #
+      # @param config_param [Boolean,String] the value to check
+      # @return [Boolean] should the value be treated as `false`
+      def false? config_param
+        return false if config_param == true
+        return true if config_param == false
+        return false unless config_param.cs__is_a?(String)
+
+        config_param.downcase == Contrast::Utils::ObjectShare::FALSE
+      end
+
+      # use this to determine if the configuration value is literally boolean
+      # true or some form of the word `true`, regardless of case. It should
+      # be used for those values which default to `false` as they should only
+      # treat a value explicitly set to `true` as such.
+      #
+      # @param config_param [Boolean,String] the value to check
+      # @return [Boolean] should the value be treated as `true`
+      def true? config_param
+        return false if config_param == false
+        return true if config_param == true
+        return false unless config_param.cs__is_a?(String)
+
+        config_param.downcase == Contrast::Utils::ObjectShare::TRUE
+      end
+
+      # this method will check if a path could be possibly used
+      # So for example if we pass a path to a file - we'll check
+      # if there is actually that file and if it's with certain extension
+      #
+      # @param config_path [String,nil]
+      # @return [Boolean]
+      def valid_cert? config_path
+        return false if config_path.nil?
+
+        exts = %w[.pem .crt .cer].cs__freeze
+        return false unless exts.include?(File.extname(config_path))
+
+        true
+      end
+
+      # check if file exists at all
+      # @param path [String,nil]
+      def file_exists? path
+        return false unless path
+
+        File.exist?(path)
+      end
+
+      # Converts current configuration to effective config values class and appends them to
+      # EffectiveConfig class.
+      #
+      # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+      def to_effective_config effective_config
+        add_effective_config_values(effective_config, config_values, canon_name, "#{ CONTRAST }.#{ canon_name }")
+      end
+
+      # attempts to stringifys the config value if it is an array with the join char
+      # @param val[Object] val to stringify
+      # @param join_char[String, ','] join character defaults to ','
+      # @return [String, Object] the stringified val or the object as is
+      def stringify_array val, join_char = ','
+        return val.join(join_char) if val.cs__is_a?(Array)
+
+        val
+      end
+    end
+  end
+end

data/lib/contrast/components/config/sources.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/env_configuration_item'
+require 'ougai'
+require 'contrast/configuration'
+
+module Contrast
+  module Components
+    module Config
+      # This component encapsulates storing the source for each entry in the config,
+      # so that we can report on where the value was set from.
+      class Sources
+        ENVIRONMENT = 'ENV'
+        CLI = 'CLI'
+        CONTRASTUI = 'ContrastUI'
+        DEFAULT = 'Default'
+        YAML = 'YAML'
+
+        # @return [Hash]
+        attr_reader :data
+
+        def initialize data = {}
+          @data = data
+        end
+
+        # Retrieves the current config source for the specified config path. If no source is
+        # set then returns the Default value.
+        #
+        # @param path [String] the canonical name for the config entry (such as api.proxy.enable)
+        # @return [String] the source for the entry
+        def get path
+          data.dig(*parts_for(path)) || DEFAULT
+        rescue TypeError
+          DEFAULT
+        end
+
+        # Assigns the config source for a specified config path.
+        #
+        # @param path [String] the canonical name for the config entry (such as api.proxy.enable)
+        # @param [String] the source for the entry
+        # @return [String] the source type for the entry
+        def set path, source
+          assign_value(data, parts_for(path), source)
+        end
+
+        # Finds entries within config source data for the specified type, and returns
+        # them along with the current values for each.
+        #
+        # @param type [String] a source type (ENV, CLI, ContrastUI, YAML)
+        # @return [Hash] the entries for the provided source, along with the associated values
+        def for type
+          deep_select(data.dup, type, [])
+        end
+
+        private
+
+        # @param path [String] the canonical name for a config entry (such as api.proxy.enable)
+        # @return [Array] the path split on periods, and converted to symbols
+        def parts_for path
+          path.split('.').map(&:to_sym)
+        end
+
+        # @param current_level [Hash] all, or some of, the config source information
+        # @param parts [Array] the parts for canonical name of the config entry
+        # @param source [String] the source to be set for the specified entry
+        # @return [Array] the path split on periods, and converted to symbols
+        def assign_value current_level, parts, source
+          parts[0...-1].each do |segment|
+            current_level[segment] ||= {}
+            current_level = current_level[segment]
+          end
+          return unless current_level.cs__is_a?(Hash)
+
+          current_level[parts[-1]] = source
+        end
+
+        # @param sources [Hash] all, or some of, the config source information
+        # @param type [Array] the source type to look for entries of
+        # @param path [String] the entries followed to get to this part of the config
+        # @return [Hash] the entries for the provided source, along with the associated values
+        def deep_select sources, type, path
+          sources.each_with_object({}) do |(k, v), grouping|
+            if v.cs__is_a?(Hash)
+              nested_data = deep_select(v, type, path.dup.append(k.to_sym))
+              grouping[k] = nested_data unless nested_data.empty?
+            elsif v == type
+              grouping[k] = Contrast::CONFIG.config.loaded_config.dig(*path, k)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/config.rb

@@ -1,9 +1,10 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/boolean_util'
-cs__scoped_require 'contrast/utils/env_configuration_item'
-cs__scoped_require 'contrast/configuration'
+require 'contrast/utils/env_configuration_item'
+require 'ougai'
+require 'contrast/configuration'
+require 'contrast/config/diagnostics'
 
 module Contrast
   module Components
@@ -23,98 +24,156 @@ module Contrast
     # it should break LOUDLY.  Better to waste half an hour of the sysadmin's
     # time than to silently fail to deliver functionality.
     module Config
-      LOG_CONFIGURATION_DISABLED = 'Contrast disabled by configuration. Continuing without instrumentation.'
-      CONTRAST_ENV_MARKER        = 'CONTRAST__'
+      CONTRAST_ENV_MARKER = 'CONTRAST__'
+      CONTRAST_LOG = 'contrast_agent.log'
+      CONTRAST_NAME = 'Contrast Agent'
+      DATE_TIME = '%Y-%m-%dT%H:%M:%S.%L%z'
+
+      class Interface # :nodoc: # rubocop:disable Metrics/ClassLength
+        SESSION_VARIABLES = 'Invalid configuration. ' \
+                            "Setting both application.session_id and application.session_metadata is not allowed.\n"
+        API_URL = "Invalid configuration. Missing a required connection value 'url' is not set."
+        API_KEY = "Invalid configuration. Missing a required connection value 'api_key' is not set."
+        API_SERVICE_KEY = "Invalid configuration. Missing a required connection value 'service_tag' is not set."
+        API_USERNAME = "Invalid configuration. Missing a required connection value 'user_name' is not set."
+
+        attr_reader :config
 
-      class Interface # :nodoc:
         def initialize
           build
         end
 
-        def build log: true
+        # Basic logger for handling configuration validation logging
+        # the file to log is determined by the default one or set
+        # by the config file, if that configuration is found
+        def proto_logger
+          @_proto_logger ||= begin
+            @_proto_logger = ::Ougai::Logger.new(logger_path || CONTRAST_LOG)
+            @_proto_logger.progname = CONTRAST_NAME
+            @_proto_logger.level = ::Ougai::Logging::Severity::WARN
+            @_proto_logger.formatter = Contrast::Logger::Format.new
+            @_proto_logger.formatter.datetime_format = DATE_TIME
+            @_proto_logger
+          end
+        end
+
+        def build
           @_valid = nil
           @config = Contrast::Configuration.new
-          defaults
-          overrides
-          validate(log: log)
+          env_overrides
+          validate
+        rescue ArgumentError => e
+          proto_logger.error('Configuration failed with error: ', e)
         end
         alias_method :rebuild, :build
 
-        # Prefer abstraction, but use #raw if you need.
-        # grep 'CONFIG.raw' for opportunities to refactor.
-        def raw
-          @config
+        # @return [Contrast::Components::Api::Interface]
+        def api
+          @config.api
         end
 
-        def root
-          raw.root
+        # @return [Contrast::Components::Agent::Interface]
+        def agent
+          @config.agent
         end
 
-        def enabled?
-          Contrast::Utils::BooleanUtil.true?(raw.enable)
+        # @return [Contrast::Components::AppContext::Interface]
+        def application
+          @config.application
         end
 
-        def disabled?
-          !enabled?
+        # @return [Contrast::Config::ServerConfiguration]
+        def server
+          @config.server
         end
 
-        def protect?
-          Contrast::Utils::BooleanUtil.true?(raw.protect.enable)
+        # @return [Contrast::Components::Assess::Interface]
+        def assess
+          @config.assess
         end
 
-        def assess?
-          Contrast::Utils::BooleanUtil.true?(raw.assess.enable)
+        # @return [Contrast::Components::Inventory::Interface]
+        def inventory
+          @config.inventory
         end
 
-        def session_id
-          @_session_id ||= begin
-                             s = raw.application.session_id || ''
-                             s.empty? ? nil : s
-                           end
+        # @return [Contrast::Components::Protect::Interface]
+        def protect
+          @config.protect
         end
 
-        def session_metadata
-          @_session_metadata ||= begin
-                                   s = raw.application.session_metadata || ''
-                                   s.empty? ? nil : s
-                                 end
+        def valid?
+          @_valid = validate if @_valid.nil?
+          @_valid
         end
 
-        def valid?
-          @_valid = validate(log: false) if @_valid.nil?
+        def enable
+          @config.enable
+        end
+
+        def sources
+          @config.sources
         end
 
         def invalid?
           !valid?
         end
 
+        def loggable
+          @config.loggable
+        end
+
+        # Typically, this would be accessed through Contrast::SETTINGS, but we're specifically checking for the user
+        # provided value here rather than that echoed back by TeamServer.
+        #
+        # @return [String,nil] the value of the session id set in the configuration, or nil if unset
+        def session_id
+          application.session_id
+        end
+
+        # @return [String,nil] the value of the session metadata set in the configuration, or nil if unset
+        def session_metadata
+          application.session_metadata
+        end
+
+        # @return [String, nil] the path to the YAML config file, if any.
+        def config_file_path
+          config.config_file
+        end
+
         private
 
-        SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
-        def validate log: false
-          # The config has information about how to construct the logger.
-          # If the config is invalid, and you want to know about it, then
-          # you have a circular dependency if you try to log it,
-          # hence `log: false`.
-          if session_id && session_metadata
-            if log
-              cs__class.log_error(SESSION_VARIABLES)
-            else
-              puts SESSION_VARIABLES
-            end
-            return false
-          end
+        # The config has information about how to construct the logger. If the config is invalid, and you want to know
+        # about it, then you have a circular dependency if you try to log it, so we use basic proto_logger to do this
+        # job.
+        def validate
+          return false unless valid_session_metadata?
 
-          true
+          valid_api?
         end
 
-        def defaults
-          raw.agent.service.host ||= Contrast::Configuration::DEFAULT_HOST
-          raw.agent.service.port ||= Contrast::Configuration::DEFAULT_PORT
+        # The use can set either the application's session id or session metadata or neither, but never both.
+        #
+        # @return [boolean]
+        def valid_session_metadata?
+          if !session_id&.empty? && !session_metadata&.empty?
+            proto_logger.error(SESSION_VARIABLES)
+            return false
+          end
+          true
         end
 
-        def overrides
-          env_overrides
+        # The agent must have the configuration values required for the connection to TeamServer.
+        #
+        # @return [boolean]
+        def valid_api?
+          msg = []
+          msg << API_URL unless api_url
+          msg << API_KEY unless api_key
+          msg << API_SERVICE_KEY unless api_service_key
+          msg << API_USERNAME unless api_username
+          msg.any? { |m| proto_logger.error(m) }
+          msg.empty?
         end
 
         def env_overrides
@@ -124,12 +183,75 @@ module Contrast
             next unless env_key.to_s.start_with?(CONTRAST_ENV_MARKER)
 
             config_item = Contrast::Utils::EnvConfigurationItem.new(env_key, env_value)
-            raw.assign_value_to_path_array(config_item.dot_path_array, config_item.value)
+            assign_value_to_path_array(self, config_item.dot_path_array, config_item.value)
           end
         end
-      end
 
-      COMPONENT_INTERFACE = Interface.new
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_url
+          api.url
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_key
+          api.api_key
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_service_key
+          api.service_key
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::API, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def api_username
+          api.user_name
+        end
+
+        # Typically, the following values would be accessed through Contrast::Components::AppContext
+        # and Contrast::Components::Logger, but we're too early in the initialization of the Agent to use
+        # that mechanism, so we look it up directly for ourselves.
+        #
+        # @return [String, nil]
+        def logger_path
+          agent.logger.path
+        end
+
+        # This methods is here to add the proper forward towards @config
+        def enable= value
+          @config.enable = value
+        end
+
+        # Assign the value from an ENV variable to the Contrast::Config::RootConfiguration object, when
+        # appropriate.
+        #
+        # @return nil
+        def assign_value_to_path_array current_level, dot_path_array, value
+          dot_path_array[0...-1].each do |segment|
+            segment = segment.tr('-', '_')
+            current_level = current_level.send(segment) if current_level.cs__respond_to?(segment)
+          end
+          return unless current_level.nil? == false && current_level.cs__respond_to?(dot_path_array[-1])
+
+          current_level.send("#{ dot_path_array[-1] }=", value)
+          sources.set(dot_path_array.join('.'), Contrast::Components::Config::Sources::ENVIRONMENT)
+        end
+      end
     end
   end
 end

data/lib/contrast/components/heap_dump.rb

@@ -1,9 +1,72 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+require 'contrast/config/base_configuration'
+
 module Contrast
   module Components
     module HeapDump
+      # Interface used to build the HeapDump settings and component.
+      class Interface
+        include Contrast::Config::BaseConfiguration
+        include Contrast::Components::ComponentBase
+
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        DEFAULT_PATH = 'contrast_heap_dumps' # saved
+        DEFAULT_MS = 10_000
+        DEFAULT_COUNT = 5
+        CANON_NAME = 'agent.heap_dump'
+        CONFIG_VALUES = %w[enable path delay_ms window_ms count clean].cs__freeze
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @_enable = hsh[:enable]
+          @_path = hsh[:path]
+          @_delay_ms = hsh[:delay_ms]
+          @_window_ms = hsh[:window_ms]
+          @_count = hsh[:count]
+          @_clean = hsh[:clean]
+        end
+
+        # @return [Boolean, String] should dumps be taken
+        def enable
+          @_enable.nil? ? Contrast::Utils::ObjectShare::FALSE : @_enable
+        end
+
+        # @return [String, DEFAULT_PATH] dir to which dumps should be
+        def path
+          @_path ||= DEFAULT_PATH
+        end
+
+        # @return [Integer, DEFAULT_MS] time, in ms, after initialization
+        def delay_ms
+          @_delay_ms ||= DEFAULT_MS
+        end
+
+        # @return [Integer, DEFAULT_MS] ms between each dump
+        def window_ms
+          @_window_ms ||= DEFAULT_MS
+        end
+
+        # @return [Integer, DEFAULT_COUNT] number of dumps to take
+        def count
+          @_count ||= DEFAULT_COUNT
+        end
+
+        # @return [Boolean, String] remove temporary objects or not
+        def clean
+          @_clean.nil? ? Contrast::Utils::ObjectShare::FALSE : @_clean
+        end
+      end
+
       # A wrapper build around the Common Agent Configuration project to allow
       # for access of the values contained in its
       # parent_configuration_spec.yaml.
@@ -11,24 +74,26 @@ module Contrast
       # utility.
       module ClassMethods
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-
-        access_component :config
 
         def heap_dump_enabled?
-          state.heap_dump_enabled?
+          heap_dump_control[:enabled]
         end
 
         def heap_dump_control
-          {
-              path: File.absolute_path(CONFIG.root.agent.heap_dump.path),
-              count: CONFIG.root.agent.heap_dump.count.to_i,
-              window: CONFIG.root.agent.heap_dump.window_ms.to_f / 1000,
-              delay: CONFIG.root.agent.heap_dump.delay_ms.to_f / 1000,
-              clean: true?(CONFIG.root.agent.heap_dump.clean)
-          }
+          @_heap_dump_control ||= begin
+            config = ::Contrast::CONFIG&.agent&.heap_dump
+            {
+                enabled: true?(config&.enable),
+                path: File.absolute_path(config&.path),
+                count: config&.count.to_i || 0,
+                window: (config&.window_ms.to_f || 0) / 1000,
+                delay: (config&.delay_ms.to_f || 0) / 1000,
+                clean: true?(config&.clean)
+            }
+          end
         end
       end
+      InstanceMethods = ClassMethods
     end
   end
 end

data/lib/contrast/components/inventory.rb

@@ -1,23 +1,50 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+
 module Contrast
   module Components
     module Inventory
-      # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
-      # Specifically, this allows for querying the state of the Inventory
-      # product.
+      # Interface component for Inventory settings used to store the values from
+      # settings file and assert state with check methods.
       class Interface
         include Contrast::Components::ComponentBase
 
-        def enabled?
-          state.inventory_enabled?
+        CANON_NAME = 'inventory'
+        CONFIG_VALUES = %w[enable analyze_libraries tags].cs__freeze
+
+        attr_writer :tags
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @enable = !false?(hsh[:enable])
+          @analyze_libraries = !false?(hsh[:analyze_libraries])
+          @tags = hsh[:tags]
         end
-      end
 
-      COMPONENT_INTERFACE = Interface.new
+        # return [Boolean]
+        def enable
+          @enable.nil? ? true : @enable
+        end
+
+        # return [Boolean]
+        def analyze_libraries
+          @analyze_libraries.nil? ? true : @analyze_libraries
+        end
+
+        # @return [String, nil] tags
+        def tags
+          stringify_array(@tags)
+        end
+      end
     end
   end
 end