contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/response_utils.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # used in Contrast::Agent::Response
+    module ResponseUtils
+      private
+
+      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
+
+      # Given some holder of the content of the response's body, extract that
+      # content and return it as a String
+      #
+      # @param body [String, Rack::File, Rack::BodyProxy,
+      #   ActionDispatch::Response::RackBody, Rack::Response] Something that
+      #   holds, wraps, or is the body of the Response
+      # @return [nil, String] the content of the body
+      def extract_body body
+        return unless body
+        return if body_is_file?(body)
+
+        return handle_rack_body_proxy(body) if body.is_a?(Rack::BodyProxy)
+        return extract_body(body.body) if sub_extractable?(body)
+        return enumerable_text_from(body) if Contrast::Utils::DuckUtils.quacks_to?(body, :each)
+        # https://stackoverflow.com/questions/15654676/how-to-convert-activesupportsafebuffer-to-string
+        return body.to_str if body.is_a?(ActionView::OutputBuffer)
+
+        read_or_string(body)
+      end
+
+      def sub_extractable? body
+        (defined?(ActionDispatch::Response::RackBody) && body.is_a?(ActionDispatch::Response::RackBody)) ||
+            body.is_a?(Rack::Response)
+      end
+
+      def enumerable_text_from body
+        entries = body.map { |entry| read_or_string(entry) }
+        entries.compact!
+        entries.join(Contrast::Utils::ObjectShare::NEW_LINE)
+      end
+
+      def handle_rack_body_proxy body
+        next_body = body.instance_variable_get(:@body)
+        case next_body
+        when Array
+          extract_body(next_body[0])
+        else
+          extract_body(next_body)
+        end
+      end
+
+      def read_or_string obj
+        return unless obj
+
+        if Contrast::Utils::DuckUtils.quacks_to?(obj, :read)
+          tmp = obj.read
+          obj.rewind
+          tmp
+        else
+          obj.to_s
+        end
+      end
+
+      # After Rack 3.1 gets live - line 88 (Rack::File) will be removed.
+      # In 3.1 version, they drop the support for File class and will only support Files class
+      #
+      # @param body [String, Rack::File, Rack::BodyProxy,
+      #   ActionDispatch::Response::RackBody, Rack::Response] Something that
+      #   holds, wraps, or is the body of the Response
+      def body_is_file? body
+        return true if defined?(Rack::File) && (body.is_a?(Rack::File) || body.is_a?(Rack::File::Iterator))
+        return true if defined?(Rack::Files) && (body.is_a?(Rack::Files) || body.is_a?(Rack::Files::Iterator))
+
+        false
+      end
+    end
+  end
+end

data/lib/contrast/utils/routes_sent.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# require 'contrast/components/logger'
+require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Utils
+    # This is the RoutesSent class, which determines whether observed routes can be sent to TeamServer.
+    # Routes that have not been seen (according to the cache) can be sent, as well as any route that
+    # # has been seen but not within the time limit.
+    class RoutesSent
+      # include Contrast::Components::Logger::InstanceMethods
+      ROUTES_LIMIT = 500
+      TIME_LIMIT_IN_SECONDS = 60
+
+      attr_accessor :cache
+
+      def initialize
+        @cache = {}
+      end
+
+      # Determine whether the provided route can be sent to TeamServer.
+      #
+      # @param route [Contrast::Agent::Reporting::ObservedRoute] the route
+      # @return [boolean]
+      def sendable? route
+        return false if Contrast::Utils::DuckUtils.empty_duck?(route.signature)
+        return false if Contrast::Utils::DuckUtils.empty_duck?(route.url)
+
+        route_hash = route.hash_id
+
+        # If hash doesn't exist in @cache...
+        #   - Add hash to @cache (with Time.now)
+        #   - Clear oldest entries (if more than ROUTES_LIMIT)
+        #   - Return *true*
+        unless cache.key?(route_hash)
+          cache[route_hash] = Time.now
+          remove_oldest_entries!
+          return true
+        end
+
+        # If hash exists in @cache...
+        #   - Return *true* if more than a minute since time recorded for hash
+        #   - Return *false* if not than a minute since time recorded for hash
+        return false unless Time.now.to_i - cache.fetch(route_hash, 0).to_i > TIME_LIMIT_IN_SECONDS
+
+        cache[route_hash] = Time.now
+        true
+      end
+
+      private
+
+      def remove_oldest_entries!
+        return if cache.size < ROUTES_LIMIT
+
+        route_hashes = cache.sort_by { |_, v| -v.tv_nsec }.
+            to_h.keys.slice(0, ROUTES_LIMIT)
+        @cache = cache.slice(*route_hashes)
+      end
+    end
+  end
+end

data/lib/contrast/utils/sha256_builder.rb

@@ -1,24 +1,24 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'singleton'
-cs__scoped_require 'contrast/utils/object_share'
+require 'singleton'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Utils
     # Utility methods for building and caching hashes from strings
     class Sha256Builder
       include Singleton
+      # Return a list of "source" files. Ignore metadata files as well as files
+      # in the spec, test or exe directories. Could potentially miss important
+      # files but good enough for the time being.
+      PATHS = '{lib,bin,ext}/**/*.{rb,c,h,c++,cpp,java,rs}'
 
       def initialize
         @sha256_cache = {}
         @gem_hash_cache = {}
       end
 
-      # Return a list of "source" files. Ignore metadata files as well as files
-      # in the spec, test or exe directories. Could potentially miss important
-      # files but good enough for the time being.
-      PATHS = '{lib,bin,ext}/**/*.{rb,c,h,c++,cpp,java,rs}'
       def files path
         if Dir.exist?(path)
           Dir.glob(File.join(path, PATHS))
@@ -29,8 +29,8 @@ module Contrast
 
       # Generate a SHA256 hash of the combined source code of this Gem
       def sha256 path
-        return nil unless path
-        return nil unless File.exist?(path) && !File.directory?(path)
+        return unless path
+        return unless File.exist?(path) && !File.directory?(path)
 
         @sha256_cache[path] ||= Digest::SHA256.file(path).to_s
       end
@@ -52,18 +52,6 @@ module Contrast
         parent_dir = File.dirname(gems_dir)
         File.join(parent_dir, Contrast::Utils::ObjectShare::CACHE)
       end
-
-      def self.files path
-        instance.files(path)
-      end
-
-      def self.sha256 path
-        instance.sha256(path)
-      end
-
-      def self.build_from_spec spec
-        instance.build_from_spec(spec)
-      end
     end
   end
 end

data/lib/contrast/utils/silence_maker.rb

@@ -0,0 +1,16 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Silence sometimes is a bliss.
+    module SilenceMaker
+      def self.hush &block
+        old_verbose, $VERBOSE = $VERBOSE, nil # rubocop:disable Style/ParallelAssignment
+        yield(block)
+      ensure
+        $VERBOSE = old_verbose
+      end
+    end
+  end
+end

data/lib/contrast/utils/stack_trace_utils.rb

@@ -1,208 +1,92 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/api'
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample_stack'
 
 module Contrast
   module Utils
     # Utilities for converting ruby stack trace into DTMs
     class StackTraceUtils
-      CONTRAST_MARKER = 'contrast/extensions/ruby_core'
-      MONKEYPATCH_MARKER = 'cs__'
-
-      # TODO: RUBY-532
-      CLASSNAME_CACHE = Contrast::Utils::Cache.new
-
       # need lib here to separate from specs
-      AGENT_CLASS_MARKERS = %w[
-        /lib/contrast/
-      ].cs__freeze
-
-      def self.custom_code_context?
-        stack = Kernel.caller(0, 15)
-        i = 0
-        while i < stack.length
-          stack_element = stack[i]
-          if stack_element.include?('contrast')
-            # Noop
-          elsif stack_element.include?('gems')
-            return false
-          else
-            return true
+      AGENT_CLASS_MARKER = '/lib/contrast/'
+
+      class << self
+        # Determine if this method is being invoked by application code or not
+        # based on the immediate caller of the code after Contrast.
+        #
+        # @return [Boolean] true if this code is called with application
+        #   (non-gem) code in the caller
+        def custom_code_context?
+          root_dir = Contrast::Agent.framework_manager.app_root
+
+          stack = Kernel.caller(0, 15)
+          i = 0
+          while i < stack.length
+            stack_element = stack[i]
+            i += 1
+            next if stack_element.include?('/contrast/')
+
+            return stack_element.start_with?(root_dir)
           end
-          i += 1
         end
-      end
-
-      def self.build(
-          skip: 0,
-          depth: 10,
-          ignore: false,
-          ignore_strings: AGENT_CLASS_MARKERS,
-          class_lookup: false,
-          rasp_element: true)
 
-        stack = caller(skip.to_i, depth.to_i)
-        return [] unless stack
-
-        stack = reject_caller_entries(stack, ignore_strings) if ignore
-        stack.map! do |entry|
-          element = rasp_or_assess(rasp_element)
-          element = fill_element(element, entry, class_lookup)
-          element
+        # Call and translate a caller_locations array to an array of
+        # ApplicationDefendAttackSampleStack for TeamServer to display, excluding any Contrast
+        # code found.
+        #
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>]
+        def build_protect_report_stack_array
+          build_protect_stack(Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack)
         end
-        stack.compact!
-        stack
-      end
 
-      def self.reject_caller_entries stack, ignore_strings
-        return stack unless ignore_strings&.any?
+        private
 
-        stack.reject do |entry|
-          ignore_strings.any? { |marker| entry.include?(marker) } ||
-              entry.include?(MONKEYPATCH_MARKER)
+        def reject_caller_entries stack
+          stack.reject do |entry|
+            entry = entry.to_s
+            entry.include?(AGENT_CLASS_MARKER)
+          end
         end
-      end
 
-      def self.rasp_or_assess rasp_element
-        if rasp_element
-          Contrast::Api::Dtm::StackTraceElement.new
-        else
-          Contrast::Api::Dtm::TraceStack.new
+        # @param clazz [Class] Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>]
+        def build_protect_stack clazz
+          stack = caller(3, 21)
+          return [] unless stack
+
+          stack = reject_caller_entries(stack)
+          i = 0
+          stack.map! do |entry|
+            element = clazz.new
+            element = fill_protect_element(element, entry, i)
+            i += 1
+            element
+          end
+          stack.compact!
+          stack
         end
-      end
 
-      def self.to_dtm_stack stack_locations: nil, rasp_element: true
-        return [] unless stack_locations
+        # In Contrast UI - there are many ways to render the stacktraces. For
+        # Protect, there are two ways we're concerned about, one for the first
+        # element and then all others.
+        # 1 for protect first frame - We need the method specifically for this rendering
+        # 1 for protect Nth frames
+        def fill_protect_element element, caller_location, index
+          return element unless caller_location
+
+          if index.zero?
+            element.method_name = caller_location.split('`')[-1].delete_suffix!('\'')
+            element.file_name = caller_location.split(':')[0]
+          else
+            element.file_name = caller_location
+          end
 
-        stack_locations = reject_locations(stack_locations)
-        stack_locations.map! do |caller_location|
-          element = rasp_or_assess(rasp_element)
-          element = fill_loc_element(element, caller_location)
           element
+        rescue StandardError
+          # NOOP
+          nil
         end
-        stack_locations.compact!
-        stack_locations
-      end
-
-      def self.reject_locations stack_locations
-        stack_locations.reject do |entry|
-          class_path = entry.path
-          method = entry.label
-          AGENT_CLASS_MARKERS.any? { |marker| class_path.include?(marker) } ||
-              method.include?(MONKEYPATCH_MARKER)
-        end
-      end
-
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_element element, str, class_lookup
-        return element if str.nil? || str.strip.empty?
-
-        path, line, method = str.split(':')
-        element.line_number = line.to_i
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        declaring_class = best_classname(path, element.file_name) if class_lookup
-        element.declaring_class = Contrast::Utils::StringUtils.force_utf8(declaring_class)
-        method_name = find_method_name(method)
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(method_name)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
-
-      def self.best_classname path, file
-        name = first_class(path)
-        name || look_like_classname(file)
-      end
-
-      # "/.rvm/rubies/ruby-1.9.3-p551/lib/ruby/1.9.1/irb/workspace.rb:80:in `eval'"
-      def self.fill_loc_element element, caller_location
-        return element unless caller_location
-
-        lineno = caller_location.lineno
-        element.line_number = lineno.to_i
-        path = caller_location.path
-        path = Contrast::Utils::StringUtils.force_utf8(path)
-        file_name = filename_from_path(path)
-        element.file_name = Contrast::Utils::StringUtils.force_utf8(file_name)
-        element.declaring_class = path
-        label = caller_location.label
-        element.method_name = Contrast::Utils::StringUtils.force_utf8(label)
-        element
-      rescue StandardError
-        # NOOP
-        nil
-      end
-
-      def self.filename_from_path path
-        file_idx = path.rindex(Contrast::Utils::ObjectShare::SLASH)
-        if file_idx
-          txt_idx = file_idx + 1
-          path[txt_idx, path.length - txt_idx]
-        else
-          path
-        end
-      end
-
-      # Bit of a HACK: Given a path to a file, assume that the first line in the
-      # form `class Name` is the class that was loaded. True most of the time.
-      #
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /\s*class\s+([_[:alpha:]][_[:alnum:]]*)/m
-      CLASS_MARKER = ' class '
-      CLASS_END_MARKER = Contrast::Utils::ObjectShare::NEW_LINE
-      def self.first_class path
-        return nil if path.nil? || path.empty?
-
-        name = CLASSNAME_CACHE[path]
-        return name if name
-
-        text = File.read(path)
-        name = parse_string(text, CLASS_MARKER, CLASS_END_MARKER)
-        CLASSNAME_CACHE[path] = name if name
-        name
-      end
-
-      RB_MARKER = '.rb'
-      # Convert a file to look like a classname
-      # If the file ends w/ '.rb', trim that off
-      # If the file doesn't start with a capital letter,
-      # capitalize it
-      def self.look_like_classname file
-        file = file.to_s
-        file[0].capitalize + (file.end_with?(RB_MARKER) ? file.slice(1..-4) : file.slice(1..-1))
-      end
-
-      # Using regexp here is expensive b/c it creates a ton of new Strings. We're
-      # trying to avoid that, so our guess is a little more clumsy, but should
-      # still work.
-      #
-      # Note: Might need to tune end marker to include /n
-      # based on: /[`]([^']*)[']/
-      METHOD_MARKER = Contrast::Utils::ObjectShare::TICK
-      METHOD_END_MARKER = Contrast::Utils::ObjectShare::COMMA
-      def self.find_method_name method
-        parse_string(method, METHOD_MARKER, METHOD_END_MARKER)
-      end
-
-      def self.parse_string string, start_marker, end_marker
-        return nil unless string
-
-        start_idx = string.index(start_marker)
-        return nil unless start_idx
-
-        start_idx += start_marker.length # account for marker length
-        end_idx = string.index(end_marker, start_idx)
-        end_idx ||= string.length
-        len = end_idx - start_idx
-        string[start_idx, len]
       end
     end
   end

data/lib/contrast/utils/string_utils.rb

@@ -1,70 +1,100 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
-    class StringUtils
-      UTF8 = 'utf-8'
-      HTTP_PREFIX = 'HTTP-'
+    module StringUtils
+      class << self
+        UTF8 = 'utf-8'
+        HTTP_PREFIX = 'HTTP_'
 
-      # Convenience method. We assume that we're working on Strings or tags
-      # String representations of things. To that end, we'll to_s anything
-      # that comes in before returning its length.
-      #
-      # But don't worry though, String.to_s just returns self. teehee
-      def self.ret_length string
-        string.nil? ? 0 : string.to_s.length
-      end
+        # Convenience method. We assume that we're working on Strings or tags
+        # String representations of things. To that end, we'll to_s anything
+        # that comes in before returning its length.
+        #
+        # But don't worry though, String.to_s just returns self. teehee
+        def ret_length string
+          string.nil? ? 0 : string.to_s.length
+        end
 
-      # Protobuf has a very strict typing. Nil is not a String and will throw
-      # an exception if you try to set it. Use this to be safe.
-      # Uses the object share to avoid creating several new strings per request
-      def self.protobuf_safe_string string
-        string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
-      end
+        def present? str
+          !str.nil? && !str.to_s.empty?
+        end
 
-      # Truncate a string to 255 characters max length
-      def self.truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
-        return default if str.nil?
+        # Protobuf has a very strict typing. Nil is not a String and will throw
+        # an exception if you try to set it. Use this to be safe.
+        # Uses the object share to avoid creating several new strings per request
+        def protobuf_safe_string string
+          string.nil? ? Contrast::Utils::ObjectShare::EMPTY_STRING : string.to_s
+        end
 
-        str.to_s[0..255]
-      end
+        # Truncate a string to 255 characters max length
+        #
+        # @param str [String] the string tt truncate
+        # @param default [String] what to default to
+        # @return [String]
+        def truncate str, default = Contrast::Utils::ObjectShare::EMPTY_STRING
+          return default if str.nil?
 
-      def self.force_utf8 str, logger = nil
-        return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
+          str.to_s[0..255]
+        end
+
+        # Cast the given object, which should be a String, into a UTF-8 String for reporting. All given objects will be
+        # cast to their to_s form, except nil which will become the ObjectShare::EMPTY_STRING, and then cast.
+        #
+        # @param str [String, Object, nil]
+        # @return [String]
+        def force_utf8 str
+          return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
+
+          str = str.to_s
+          if str.encoding == Encoding::UTF_8
+            str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
+          else
+            str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
+          end
+          str.to_s
+        rescue StandardError => e
+          # We were unable to switch the String to a UTF-8 format.
+          # Return non-nil so as not to throw an exception later when trying
+          # to do regexp or other compares on the String
+          Contrast::CONFIG.proto_logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
-        str = str.to_s
-        if str.encoding == Encoding::UTF_8
-          str = str.encode(UTF8, invalid: :replace, undef: :replace) unless str.valid_encoding?
-        else
-          str = str.encode(UTF8, str.encoding, invalid: :replace, undef: :replace)
+          Contrast::Utils::ObjectShare::EMPTY_STRING
         end
-        str.to_s
-      rescue StandardError => e
-        # We were unable to switch the String to a UTF-8 format.
-        # Return non-nil so as not to throw an exception later when trying
-        # to do regexp or other compares on the String
-        logger&.debug "Unable to change '#{ str }' to valid UTF-8: #{ e.message }"
 
-        Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
+        # Given a string return a normalized version of that string.
+        # Keys are memoized so that the normalization process doesn't need
+        # to happen every time.
+        #
+        # @param str [String] the String to normalize
+        # @return [String] a copy of the given String, upper cased, trimmed,
+        #   dashes replaced with underscore, and HTTP trimmed
+        def normalized_key str
+          return unless str
+
+          str = str.to_s
+          @_normalized_keys ||= {}
+          if @_normalized_keys.key?(str)
+            @_normalized_keys[str]
+          else
+            upped = str.upcase
+            stripped = upped.strip! || upped
+            trimmed = stripped.tr!('-', '_') || stripped
+            cut = trimmed.start_with?(HTTP_PREFIX) ? trimmed[5..] : trimmed
+            @_normalized_keys[str] = cut
+          end
+        end
 
-      # Given a string return a normalized version of that string.
-      # Keys are memoized so that the normalization process doesn't need
-      # to happen every time.
-      def self.normalized_key str
-        return nil unless str
+        # transform string from snake_case to Capitalized Text
+        #
+        # @param str[String] string to transform
+        # @return [String]
+        def transform_string str
+          return unless str
 
-        str = str.to_s
-        @_normalized_keys ||= {}
-        if @_normalized_keys.key?(str)
-          @_normalized_keys[str]
-        else
-          up = str.upcase.strip
-          up = up.gsub(/[_-]/, '-')
-          up = up[5..-1] if up.start_with?(HTTP_PREFIX)
-          @_normalized_keys[str] = up
+          str.split('-').map(&:capitalize).join(' ')
         end
       end
     end