contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/extension/protect/psych.rb

@@ -0,0 +1,7 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(Psych)
+  require 'contrast/agent/protect/policy/applies_deserialization_rule'
+  require 'cs__patched_psych/cs__patched_psych'
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect.rb

@@ -1,9 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Protect namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
@@ -11,10 +11,10 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Protect
-      cs__scoped_require 'contrast/security_exception'
+      require 'contrast/security_exception'
       # patching
-      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
-      cs__scoped_require 'contrast/agent/protect/policy/policy'
+      require 'contrast/agent/protect/policy/trigger_node'
+      require 'contrast/agent/protect/policy/policy'
     end
   end
 end

data/lib/contrast/extension/thread.rb

@@ -0,0 +1,50 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# ensure that we're being loaded with an agent
+# NOTE: THIS CLASS WILL NOT BE RELOADED B/C WE CANNOT RELOAD THE STANDARD
+# thread file
+
+# Request context is still tracked per-thread.  There isn't anything
+# particularly order-dependent or stateful about request contexts.  It
+# exists mostly for reference.
+#
+# Scope HAS to exist per-fiber.
+# Check to see if Thread#initialize has been prepended. If it hasn't, then we should use the alias approach, so that
+# others can continue to alias it. If it has been, then we must use prepend ourselves.
+if Thread.instance_method(:initialize).owner == Thread
+  # Alias-chaining Thread#initialize.
+  class Thread
+    alias_method :cs__initialize, :initialize
+
+    def initialize *args, &block
+      # Thread.current still references the original(callee) thread that is instantiating this new fiber during
+      # initialization.
+      Contrast::Components::Scope::MONITOR.synchronize do
+        if (current_context = Thread.current[:current_context])
+          self[:current_context] = current_context.dup
+        end
+
+        Contrast::Components::Scope.sweep_dead_ecs
+      end
+
+      cs__initialize(*args, &block)
+    end
+  end
+else
+  # Prepending Thread#initialize.
+  module ContrastThread
+    def initialize *args, &block
+      # Thread.current still references the original(callee) thread that is instantiating this new fiber during
+      # initialization.
+      Contrast::Components::Scope::MONITOR.synchronize do
+        if (current_context = Thread.current[:current_context])
+          self[:current_context] = current_context.dup
+        end
+        Contrast::Components::Scope.sweep_dead_ecs
+      end
+      super
+    end
+  end
+  Thread.prepend(ContrastThread)
+end

data/lib/contrast/framework/base_support.rb

@@ -1,62 +1,77 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/reporting_events/discovered_route'
+
 module Contrast
   module Framework
     # The API for all subclasses to implement to correctly support a given framework
-    class BaseSupport
-      class << self
-        # The top level module name used by the framework
-        def detection_class
-          raise NoMethodError('Subclasses of BaseSupport should implement this method')
-        end
-
-        def version
-          raise NoMethodError('Subclasses of BaseSupport should implement this method')
-        end
-
-        def application_name
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
-        def server_type
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
-        # Find all the predefined routes for this application and append them to the
-        # provided inventory message
-        # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
-        # that has a routes array consisting of Contrast::Api::Dtm::RouteCoverage
-        def collect_routes
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
-        def current_route
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
-        protected
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        def scan_view_directories view_technology_descriptors
-          view_technology_descriptors.reject(&:empty?)
-        end
+    module BaseSupport
+      # The top level module name used by the framework
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def detection_class
+        raise(NoMethodError('Subclasses of BaseSupport should implement this method'))
+      end
+
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def version
+        raise(NoMethodError('Subclasses of BaseSupport should implement this method'))
+      end
+
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def application_name
+        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
+      end
+
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def server_type
+        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
+      end
+
+      # Find all the predefined routes for this application
+      #
+      # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def collect_routes
+        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
+      end
+
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def current_route_coverage
+        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
+      end
+
+      # @raise [NoMethodError] raises error if subclass does not implement this method
+      def retrieve_request _env
+        raise(NoMethodError, 'Subclasses of BaseSupport should implement this method')
+      end
+
+      # Some Frameworks require specific patching for their classes to handle
+      # functionality like configuration scanning. To accommodate this, this
+      # method provides a place to register those patches for invocation on
+      # Agent load.
+      #
+      # By default, and hopefully in all cases, we won't need these patches,
+      # so we're allowing nil here rather than raising an exception.
+      def before_load_patches!; end
+
+      # Some Frameworks require specific patching for their classes to handle
+      # functionality like routing. To accommodate this, this method provides
+      # a place to register those patches for invocation in our
+      # AfterLoadPatcher flow.
+      #
+      # By default, and hopefully in all cases, we won't need these patches,
+      # so we're allowing nil here rather than raising an exception.
+      #
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>,nil]
+      #   those patches required for a Framework which can only be installed
+      #   once a specific module has been loaded.
+      def after_load_patches; end
+
+      # We only support websockets in rails right now, so we won't detect streaming in
+      # any other framework
+      def streaming? _env
+        false
       end
     end
   end

data/lib/contrast/framework/grape/support.rb

@@ -0,0 +1,176 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/base_support'
+require 'contrast/components/logger'
+
+module Contrast
+  module Framework
+    module Grape
+      # Used when Grape is present to define framework specific behaviour
+      class Support
+        extend Contrast::Framework::BaseSupport
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+          def detection_class
+            'Grape::API'
+          end
+
+          def version
+            ::Grape::VERSION
+          end
+
+          def application_name
+            app_class&.cs__name
+          end
+
+          def application_root
+            app_instance&.root
+          end
+
+          def server_type
+            'grape'
+          end
+
+          # Given an object, determine if it is a Grape controller.
+          # Which could include cases of ::Grape::API subclass or actual class
+          #
+          # @param app [Object] suspected Grape app.
+          # @return [Boolean]
+          def grape_controller? app
+            # Grape is loaded?
+            return false unless grape_defined?
+
+            # App is a subclass of or actually is ::Grape::API.
+            return false unless app.cs__respond_to?(:<=) && app <= ::Grape::API
+
+            true
+          end
+
+          # Find all classes that subclass ::Grape::API, Gather their routes
+          #
+          # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+          def collect_routes
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless grape_defined?
+
+            # Each Grape controller has endpoints and each endpoints has routes
+            # and that's why we need to go through each one and create separate RouteCoverage object
+            routes = []
+            grape_controllers.each do |c|
+              c&.endpoints&.each do |endpoint|
+                endpoint&.routes&.map do |r|
+                  pattern = r.pattern.pattern
+                  routes << Contrast::Agent::Reporting::DiscoveredRoute.from_grape_controller(c, r.request_method,
+                                                                                              pattern, r.path)
+                end
+              end
+            end
+            routes
+          end
+
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param controller [::Grape::API] optionally use this controller instead of global ::Grape::API.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, controller = ::Grape::API, full_route = nil
+            return unless grape_controller?(controller)
+
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+
+            # Find final controller - actually we gotta match the route to the scanned application
+            # Initially Grape compiles all routes on startup, so we can use the url from the request
+            # and create the observed route
+            # Class < Grape::API, Grape::Router::Route
+            final_controller, route_pattern = _route_recurse(method, _cleaned_route(request), grape_controllers)
+            return unless final_controller
+
+            full_route ||= request.env[::Rack::PATH_INFO]
+
+            new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+            new_route_coverage.attach_rack_based_data(final_controller, method, route_pattern, full_route)
+            new_route_coverage
+          end
+
+          # Search object space for grape controllers--any class that subclasses ::Grape::API.
+          #
+          # @return [Array<::Grape::API>] grape controllers
+          def grape_controllers
+            ObjectSpace.each_object(Class).select { |klass| klass < ::Grape::API }
+          end
+
+          # Grape Request inherits the same as the Sinatra, so we can easily call it as it's called in Sinatra
+          def retrieve_request env
+            ::Grape::Request.new(env)
+          end
+
+          private
+
+          # Determine if, at the time of our Framework Support determination, Grape has been defined.
+          #
+          # @return [Boolean]
+          def grape_defined?
+            @_grape_defined = !!(defined?(::Grape) && defined?(::Grape::API)) if @_grape_defined.nil?
+            @_grape_defined
+          end
+
+          # @param method [::Rack::REQUEST_METHOD] GET, POST, PUT, etc...
+          # @param route [String] the relative route passed from Rack.
+          # @param controllers [Array<::Grape::API>] All Grape controllers found
+          # @return [Array[::Grape::API. Grape::Router::Route], nil] Either the controller that will handle the route
+          #   along with the route pattern or nil if no match.
+          def _route_recurse method, route, controllers = grape_controllers
+            # return if there aren't any controllers
+            return unless controllers&.any?
+
+            # Here we can go through the all detected controllers
+            # and find the one that's routes include the current one
+            # Grape controller actually has endpoints and each endpoint
+            # has routes and that's why we need to do it that way
+            controller = controllers.pop
+            return _route_recurse(method, route, controllers) unless controller
+
+            contr_routes = controller.endpoints&.map(&:routes)&.flatten || []
+            route_pattern = contr_routes&.find do |r|
+              r.pattern.to_regexp.match(route) # Grape::Router::Route match
+            end
+            return controller, route_pattern unless route_pattern.nil?
+
+            _route_recurse(method, route, controllers)
+          end
+
+          # Get route and do some cleaning
+          #
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @return [String] the extracted and cleaned relative route.
+          def _cleaned_route request
+            route = request.env[::Rack::PATH_INFO]
+            return '/' if route.empty?
+
+            route.end_with?('/') ? route[0..-2] : route
+          end
+
+          def app_class
+            return unless grape_defined?
+
+            app_instance.cs__class
+          end
+
+          # Search the object space for the controller handling this request which will be
+          # the class inheriting from ::Grape::API with @app=nil
+          #
+          # @return [::Grape::API] the current controller as routed by Rack.
+          def app_instance
+            return unless grape_defined?
+
+            @_app_instance ||= begin
+              grape_layers = ObjectSpace.each_object(::Grape::API).to_a
+              grape_layers.find { |layer| layer.app.nil? }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/manager.rb

@@ -1,108 +1,160 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
-cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails_support'
-cs__scoped_require 'contrast/framework/sinatra_support'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/class_util'
+require 'contrast/agent/reporting/reporting_events/application_update'
+require 'contrast/agent/reporting/reporting_events/application_inventory'
+require 'contrast/components/logger'
+require 'contrast/extension/module'
+require 'contrast/framework/grape/support'
+require 'contrast/framework/manager_extend'
+require 'contrast/framework/rack/support'
+require 'contrast/framework/rails/support'
+require 'contrast/framework/sinatra/support'
+require 'contrast/utils/class_util'
+require 'contrast/utils/job_servers_running'
 
 module Contrast
   module Framework
     # Allows access to framework specific information
     class Manager
-      include Contrast::Components::Interface
-      access_component :logging, :analysis
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Framework::ManagerExtend
 
-      # Order here does matter as the first framework listed will be the first one we pull information from
-      # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
-      # do not exist
+      # Order here does matter as the first framework listed will be the first one we pull information from Rack will
+      # be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra do not
+      # exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::RailsSupport,
-        Contrast::Framework::SinatraSupport
+        Contrast::Framework::Rails::Support, Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Grape::Support, Contrast::Framework::Rack::Support
       ].cs__freeze
 
       def initialize
+        return if Contrast::AGENT.disabled? || Contrast::Utils::JobServersRunning.job_servers_running?
+
         @_frameworks = SUPPORTED_FRAMEWORKS.map do |framework_klass|
           next unless enable_framework_support?(framework_klass.detection_class)
 
-          logger.debug("Detected framework #{ framework_klass.detection_class } - enabling support")
+          logger.info('Framework detected. Enabling support.', framework: framework_klass.detection_class)
           framework_klass
         end
         @_frameworks.compact!
       end
 
-      def find_applicable_view_technologies
-        scan_views_for_all_frameworks
+      # Patches that have to be applied as early as possible to catch calls that happen prior to the first Request,
+      # typically those around configuration.
+      def before_load_patches!
+        @_before_load_patches ||= begin
+          SUPPORTED_FRAMEWORKS.each(&:before_load_patches!)
+          true
+        end
       end
 
-      def find_route_discovery_data
-        routes_for_all_frameworks
+      # Return all the After Load Patches for all the Frameworks we know, even if that Framework hasn't been detected.
+      #
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the AfterLoadPatches of each framework
+      def find_after_load_patches
+        patches = Set.new
+        SUPPORTED_FRAMEWORKS.each do |framework|
+          framework_patches = framework.after_load_patches
+          patches.merge(framework_patches) if framework_patches && !framework_patches.empty?
+        end
+        patches
       end
 
-      def platform_version
-        framework_version = first_framework_result :version, ''
-
-        Contrast::Framework::PlatformVersion.from_string(framework_version)
+      # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+      def find_route_discovery_data
+        routes_for_all_frameworks
       end
 
       def server_type
-        first_framework_result :server_type, 'rack'
+        first_framework_result(:server_type, 'rack')
       end
 
       def app_name
-        first_framework_result :application_name, 'root'
+        first_framework_result(:application_name, 'root')
       end
 
-      def get_route_dtm request
-        result = nil
-        @_frameworks.find do |framework_klass|
-          # TODO: RUBY-763 Sinatra::Base#call patch adds the Route report
-          next if framework_klass == Contrast::Framework::SinatraSupport
-
-          result = framework_klass.current_route(request)
-        end
-        result
+      # @return app_root [String] path
+      def app_root
+        found = first_framework_result(:application_root, nil)
+        found ||= ::Rack::Directory.new('').root
+        found.to_s
       end
 
-      private
+      # Build a request from the provided env, based on the framework(s) we're currently supporting.
+      #
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this particular Request
+      # @return [::Rack::Request] either a rack request or subclass thereof.
+      def retrieve_request env
+        # If we're mounted on Rails, use Rails.
+        if @_frameworks.include?(Contrast::Framework::Rails::Support)
+          return Contrast::Framework::Rails::Support.retrieve_request(env)
+        end
 
-      def enable_framework_support? klass
-        Contrast::Utils::ClassUtil.truly_defined?(klass)
-      end
+        # If we know the framework, use it.
+        return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
 
-      def scan_views_for_all_frameworks
-        data_for_all_frameworks :scan_views
+        # Fall back on a regular Rack::Request
+        ::Rack::Request.new(env)
+      rescue StandardError => e
+        logger.warn('Unable to retrieve_request', e)
       end
 
-      def routes_for_all_frameworks
-        data_for_all_frameworks :collect_routes
+      # @param env [Hash] the various variables stored by this and other Middlewares to know the state and values of
+      #   this particular Request
+      # @return [Boolean] true if at least one framework is streaming the response; false if none are streaming
+      def streaming? env
+        result = false
+        @_frameworks.each do |framework|
+          result = framework.streaming?(env)
+          break if result
+        end
+        result
       end
 
-      # This returns an array of all data from each framework in a flat, no-nil values array
+      # Iterate through current frameworks and return the current request's route. This will be the first non-nil
+      # result.
       #
-      # @param method_name [Symbol] the method to call on each FrameworkSupport class
-      # @return [Array]
-      def data_for_all_frameworks method_name
-        data = @_frameworks.flat_map do |framework|
-          framework.send(method_name)
-        end.compact
-        data
+      # @param request [Contrast::Agent::Request] the current request.
+      # @return [Contrast::Agent::Reporting::RouteCoverage] the current route as a Dtm.
+      def get_route_information request
+        @_frameworks&.lazy&.map { |framework_support| framework_support.current_route_coverage(request) }&.
+            reject(&:nil?)&.first
       end
 
-      # This returns a single object from the first framework to successfully respond
+      # Sometimes the framework we want to instrument is loaded after our agent code. To catch that case, we'll detect
+      # if the loaded_module is the marker class for any of our supported frameworks. If it is, and we don't already
+      # have support enabled, we'll enable it now. We'll also need to catch up on any other startup actions that we've
+      # missed. Most likely, this is only necessary for those applications which have applications mounted on them.
       #
-      # @param method_name [Symbol] the method to call on each FrameworkSupport class
-      # @return [Object] - Determined by method to be invoked
-      def first_framework_result method_name, default_value
-        result = nil
-        @_frameworks.each do |framework|
-          result = framework.send(method_name)
-          break if result
+      # TODO: RUBY-1356
+      #
+      # @param mod [Module] the module or class that was just loaded
+      def register_late_framework mod
+        return unless mod
+
+        module_name = mod.cs__name
+        # Otherwise, check if the provided module_name requires us to register a new support
+        SUPPORTED_FRAMEWORKS.each do |framework|
+          next if @_frameworks.include?(framework)
+          next unless module_name == framework.detection_class
+
+          @_frameworks << framework
+          report = Contrast::Agent::Reporting::ApplicationUpdate.new
+          # This convert here is left as it'll be easier to be replaced when the Library is being changed
+          report.libraries = Contrast::Agent::Inventory::DependencyAnalysis.instance.library_pb_list
+          [report, Contrast::Agent::Reporting::ApplicationInventory.new].each do |e|
+            Contrast::Agent.reporter.send_event(e)
+          end
+
+          logger.info('Framework detected after initialization. Enabling support.',
+                      framework: framework.detection_class,
+                      frameworks: @_frameworks)
+          break
         end
-        result || default_value
+      rescue StandardError => e
+        logger.warn('Unable to register a late framework', e, module: mod.cs__name)
       end
     end
   end