contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/components/sampling.rb

@@ -1,6 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/components/base'
+
 module Contrast
   module Components
     module Sampling
@@ -9,32 +11,171 @@ module Contrast
         DEFAULT_SAMPLING_BASELINE           = 5
         DEFAULT_SAMPLING_REQUEST_FREQUENCY  = 5
         DEFAULT_SAMPLING_RESPONSE_FREQUENCY = 25
-        DEFAULT_SAMPLING_WINDOW_MS          = 180_000 # 3 minutes, arbitrary value from Java agent
+        DEFAULT_SAMPLING_WINDOW_MS          = 180_000
       end
 
-      module ClassMethods #:nodoc:
+      module ClassMethods # :nodoc:
         include Contrast::Components::ComponentBase
         include Constants
-        include Contrast::Components::Interface
 
-        access_component :config
+        def sampling_enabled?
+          sampling_control[:enabled]
+        end
 
-        def sampling_control settings = @sampling_features
-          cas = CONFIG.root.assess&.sampling
+        def sampling_control
+          @_sampling_control ||= begin
+            config_settings = ::Contrast::CONFIG.assess&.sampling
+            settings = ::Contrast::SETTINGS&.assess_state&.sampling_settings
+            {
+                enabled: enabled?(config_settings, settings),
+                baseline: check_baseline(config_settings, settings),
+                request_frequency: check_request_frequency(config_settings, settings),
+                response_frequency: check_response_frequency(config_settings, settings),
+                window: check_window(config_settings, settings)
+            }
+          end
+        end
 
-          {
-              enabled: [cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED] .reject(&:nil?).first,
-              baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE] .map(&:to_i).find(&:positive?),
-              request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY] .map(&:to_i).find(&:positive?),
-              response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-              window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS] .map(&:to_i).find(&:positive?)
-          }
+        # Used to reset sampling when settings from TeamServer change
+        def reset_sampling_control
+          @_sampling_control = nil
+        end
+
+        private
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Agent::Reporting::Settings::Sampling, nil] the Sampling settings as provided by
+        # TeamServer
+        # @return [Boolean] the resolution of the config_settings, settings, and default value
+        def enabled? config_settings, settings
+          true?([config_settings&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].compact[0])
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Agent::Reporting::Settings::Sampling] the Sampling settings as provided by
+        # TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def check_baseline config_settings, settings
+          [config_settings&.baseline, settings&.baseline].map(&:to_i).find(&:positive?) || DEFAULT_SAMPLING_BASELINE
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Agent::Reporting::Settings::Sampling] the Sampling settings as provided by
+        # TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def check_request_frequency config_settings, settings
+          [config_settings&.request_frequency, settings&.request_frequency].map(&:to_i).find(&:positive?) ||
+              DEFAULT_SAMPLING_REQUEST_FREQUENCY
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Agent::Reporting::Settings::Sampling] the Sampling settings as provided by
+        # TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def check_response_frequency config_settings, settings
+          [config_settings&.response_frequency, settings&.response_frequency].map(&:to_i).find(&:positive?) ||
+              DEFAULT_SAMPLING_RESPONSE_FREQUENCY
+        end
+
+        # @param config_settings [Contrast::Config::SamplingConfiguration] the Sampling configuration as provided by
+        #   local user input
+        # @param settings [Contrast::Agent::Reporting::Settings::Sampling] the Sampling settings as provided by
+        # TeamServer
+        # @return [Integer] the resolution of the config_settings, settings, and default value
+        def check_window config_settings, settings
+          [config_settings&.window_ms, settings&.window_ms].map(&:to_i).find(&:positive?) || DEFAULT_SAMPLING_WINDOW_MS
         end
       end
 
-      module InstanceMethods #:nodoc:
+      module InstanceMethods # :nodoc:
         include Contrast::Components::ComponentBase
         include Constants
+        include ClassMethods
+      end
+
+      class Interface # :nodoc:
+        include InstanceMethods
+        extend ClassMethods
+        include Contrast::Config::BaseConfiguration
+
+        CANON_NAME = 'assess.sampling'
+        NAME_PREFIX = "#{ CONTRAST }.#{ CANON_NAME }"
+        CONFIG_VALUES = %w[enable baseline request_frequency response_frequency window_ms].cs__freeze
+
+        # @return [Integer, nil]
+        attr_accessor :baseline
+        # @return [Integer, nil]
+        attr_accessor :request_frequency
+        # @return [Integer, nil]
+        attr_accessor :response_frequency
+        # @return [Integer, nil]
+        attr_accessor :window_ms
+        # @return [String]
+        attr_accessor :canon_name
+
+        def initialize hsh = {}
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @enable = hsh[:enable]
+          @baseline = hsh[:baseline]
+          @request_frequency = hsh[:request_frequency]
+          @response_frequency = hsh[:response_frequency]
+          @window_ms = hsh[:window_ms]
+        end
+
+        # @return [Boolean, false]
+        def enable
+          !!@enable
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          confirm_sources
+
+          add_single_effective_value(effective_config, 'enable', sampling_control[:enabled], canon_name, NAME_PREFIX)
+          add_single_effective_value(effective_config, 'baseline', sampling_control[:baseline], canon_name, NAME_PREFIX)
+          add_single_effective_value(effective_config, 'window_ms', sampling_control[:window], canon_name, NAME_PREFIX)
+          add_single_effective_value(effective_config,
+                                     'request_frequency',
+                                     sampling_control[:request_frequency],
+                                     canon_name,
+                                     NAME_PREFIX)
+          add_single_effective_value(effective_config,
+                                     'response_frequency',
+                                     sampling_control[:response_frequency],
+                                     canon_name,
+                                     NAME_PREFIX)
+        end
+
+        private
+
+        # Confirm the sources for the sample entries to ensure that we use 'Default' if we've fallen
+        # back to the default values.
+        def confirm_sources
+          if sampling_control[:enabled] == DEFAULT_SAMPLING_ENABLED
+            Contrast::CONFIG.sources.set('assess.sampling.enable', Contrast::Components::Config::Sources::DEFAULT)
+          end
+          if sampling_control[:window] == DEFAULT_SAMPLING_WINDOW_MS
+            Contrast::CONFIG.sources.set('assess.sampling.window_ms', Contrast::Components::Config::Sources::DEFAULT)
+          end
+          {
+              'baseline' => :baseline,
+              'request_frequency' => :request_frequency,
+              'response_frequency' => :response_frequency
+          }.each do |k, v|
+            if sampling_control[v] == cs__class.cs__const_get("DEFAULT_SAMPLING_#{ v.upcase }")
+              Contrast::CONFIG.sources.set("assess.sampling.#{ k }", Contrast::Components::Config::Sources::DEFAULT)
+            end
+          end
+        end
       end
     end
   end

data/lib/contrast/components/scope.rb

@@ -1,136 +1,145 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-cs__scoped_require 'fiber'
-cs__scoped_require 'contrast/agent/scope'
+require 'fiber'
+require 'contrast/agent/scope/scope'
+require 'cs__scope/cs__scope'
 
 # This is the Scope component.
 #
-# It tracks /Contrast/ scope.  That is, "are we currently doing assess
-# or protect stuff within a patched method?" -- this is how we avoid doing
-# Contrast stuff on Contrast code.
-#
-# Separately from this component, there is also require scope, which is an
-# optimization on how we implement patching to `require`.
+# It tracks /Contrast/ scope.  That is, "are we currently doing assess or protect stuff within a patched method?" --
+# this is how we avoid doing Contrast stuff on Contrast code or creating infinite loops -- or "are we in some other
+# execution context for which we need to special case?".
 module Contrast
   module Components
-    module Scope # :nodoc:
-      MONITOR = Monitor.new
-      EXECUTION_CONTEXT = {} # rubocop:disable Style/MutableConstant
-
-      class Interface # :nodoc:
-        include Contrast::Components::ComponentBase
-
-        def initialize
-          # This is probably redundant with #scope_for_current_ec's nil check.
-          EXECUTION_CONTEXT[Fiber.current] = Contrast::Agent::Scope.new
-        end
-
-        # This returns the scope governing the current execution context.
-        # Use this sparingly, preferring the instance & class methods to
-        # access and query scope, rather than interacting with the scope
-        # object directly.
-        def scope_for_current_ec
-          MONITOR.synchronize do
-            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
-          end
+    # Constants defined in C:
+    #
+    # MONITOR = Mutex.new This was replaced from Monitor to Mutex.
+    # EXECUTION_CONTEXT = {} Hash containing all of the current ecs as keys pointing to their scope instances.
+    # EC_KEYS = [] set while we get the current ec, and used for sweeping the dead fibers in C.
+    #
+    # Methods defined in C:
+    #
+    # class Interface
+    #   initializes the scope for the current fiber context.
+    #   def initialize end;
+    #
+    #     This returns the scope governing the current execution context. Use this sparingly, preferring the instance
+    #    & class methods to access and query scope, rather than interacting with the scope object directly.
+    #   def scope_for_current_ec end;
+    # end
+    #
+    # module Scope
+    #   Singleton method for cleaning the dead fibers and unused scope instances, scope GC.
+    #   def self.sweep_dead_ecs end;
+    # end
+    module Scope
+      # Methods defined in C:
+      #
+      # For each instance method on a scope, define a forwarder to the scope on the
+      # current execution context's scope.
+      # def scope_for_current_ec end;
+      #
+      # all the methods bellow are used as forwarders to be executed in the current ec.
+      # exp: in_contrast_scope? => scope_for_current_ec.enter_contrast_scope!
+      #
+      # Check if we are in contrast scope.
+      # def in_contrast_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # check if we are in deserialization scope.
+      # def in_deserialization_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # check if we are in split scope.
+      # def in_split_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # enter contrast scope.
+      # def enter_contrast_scope! end;
+      # @return @contrast_scope [Integer] contrast scope increased.
+      #
+      # enter deserialization scope.
+      # def enter_deserialization_scope! end;
+      # @return @deserialization_scope [Integer] deserialization scope increased.
+      #
+      # enter split scope.
+      # def enter_split_scope! end;
+      # @return @split_scope [Integer] split scope increased.
+      #
+      # check split scope depth.
+      # def split_scope_depth end;
+      # @return @split_scope [Integer] split scope depth.
+      #
+      # exit contrast scope.
+      # def exit_contrast_scope! end;
+      # @return @contrast_scope [Integer] contrast scope decreased.
+      #
+      # exit deserialization scope.
+      # def exit_deserialization_scope! end;
+      # @return @deserialization_scope [Integer] deserialization scope decreased.
+      #
+      # exit split scope.
+      # def exit_split_scope! end;
+      # @return @split_scope [Integer] split scope decreased.
+      #
+      # Static methods to be used, the cases are defined by the usage from the above methods
+      #
+      # check if are in specific scope.
+      # def in_scope? name end;
+      # @param name [Symbol] scope symbol representing scope to check.
+      # @return [Boolean] check if we are in passed scope.
+      #
+      # enter specific scope.
+      # def enter_scope! name end;
+      # @param name [Symbol] scope symbol representing scope to enter.
+      # @return scope [Integer] entered scope value increased.
+      #
+      # exit specific scope.
+      # def exit_cope! name end;
+      # @param name [Symbol] scope symbol representing scope to exit.
+      # @return scope [Integer] entered scope value decreased.
+      module InstanceMethods
+        # Forwarder to execute block in contrast scope under current
+        # method execution context. On completion exits scope.
+        def with_contrast_scope
+          scope_for_current_ec.enter_contrast_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_contrast_scope!
         end
-      end
-
-      module InstanceMethods # :nodoc:
-        # For each instance method on a scope, define a forwarder
-        # to the scope on the current execution context's scope.
 
-        Contrast::Agent::Scope.public_instance_methods(false).each do |method_sym|
-          define_method(method_sym) do |*args, &block|
-            scope_for_current_ec.send(method_sym, *args, &block)
-          end
+        # Forwarder to execute block in deserialization scope under current
+        # method execution context. On completion exits scope.
+        def with_deserialization_scope
+          scope_for_current_ec.enter_deserialization_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_deserialization_scope!
         end
 
-        def scope_for_current_ec
-          MONITOR.synchronize do
-            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
-          end
+        # Forwarder to execute block in split scope under current
+        # method execution context. On completion exits scope.
+        def with_split_scope
+          scope_for_current_ec.enter_split_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_split_scope!
         end
 
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
-        #
-        # Current behavior is to no-op if we're not "in a request context".
-        # Our C functions were previously checking to see if we had a scope, because
-        # scope was tacked on to a request context -- so "we have a scope, therefore,
-        # we have a request context."  We've decoupled scopes from request contexts,
-        # so now it checks "do we have a request context."
-        # RUBY-290 should remove all of that, including this method.
-        def in_request_context?
-          !!Contrast::Agent::REQUEST_TRACKER.current
-        end
-      end
-
-      def self.sweep_dead_ecs
-        # TODO: RUBY-571, #sweep_dead_ecs compensates for a lack of weak tables
-        # 'ec' for execution context.  in this case, it's a Fiber.
-        # Threads rely on Fibers, so two birds, one stone.
-        MONITOR.synchronize do
-          EXECUTION_CONTEXT.delete_if do |ec, _scope|
-            !ec.alive?
-          end
+        # Enter app scope
+        def with_app_scope
+          scope_for_current_ec.exit_contrast_scope!
+          yield
+        ensure
+          scope_for_current_ec.enter_contrast_scope!
         end
       end
 
       ClassMethods = InstanceMethods
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end
-
-# This is a reasonable place for the Kernel#catch hook to live.
-# No current plans for component re-design, but if we had some kind of
-# "do this when a component is hooked in" thing, this would live there.
-# For now, it's over-engineering to live anywhere else.  -ajm
-module Kernel # :nodoc:
-  alias_method :cs__catch, :catch
-
-  # In the event of a `throw`, we need to override `catch`
-  # to save & restore scope state:
-  #
-  #   scope_level == 0
-  #
-  #   catch(:abc) do
-  #     with_contrast_scope do
-  #       throw :abc # will leak
-  #     end
-  #   end
-  #
-  #   scope_level == 1
-  #
-  # Frankly, this isn't how scope should be used.  This is in place of
-  # proper `ensure` blocks within the instrumentation call stack.
-  # This will actually /create/ scope leaks if you're doing something like:
-  #
-  #   catch(:ohno) do
-  #     enter scope
-  #   end
-  #
-  #   abc()
-  #
-  #   exit scope
-  #
-  # i.e. if you intend to change net scope across a catch block boundary.
-
-  private
-
-  def catch *args, &block
-    # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
-
-    # Run original catch with block.
-    retval = cs__catch(*args, &block)
-
-    # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
-
-    retval
-  end
-end

data/lib/contrast/components/security_logger.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+
+module Contrast
+  module Components
+    module SecurityLogger
+      # Here we will read and store the setting for the CEF Logging functionality
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        CANON_NAME = 'agent.security_logger'
+        CONFIG_VALUES = %w[path level].cs__freeze
+
+        # @return [String, nil]
+        attr_accessor :path
+        # @return [String, nil]
+        attr_accessor :level
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @path = hsh[:path]
+          @level = hsh[:level]
+        end
+      end
+    end
+  end
+end