contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/utils/tag_util.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,8 +7,10 @@ module Contrast
     class TagUtil
       class << self
         # Determine if the given array of tags is covered by the other
-        # remaining_ranges: the tags left that haven't been covered by those given
-        # ranges: the tags that are covering the first
+        #
+        # @param remaining_ranges [Array<Contrast::Agent::Assess::Tag>] the tags left that haven't been covered by
+        #   those given
+        # @param ranges Array<Contrast::Agent::Assess::Tag> the tags that are covering the first
         def covered? remaining_ranges, ranges
           return true unless remaining_ranges&.any?
 
@@ -19,16 +21,15 @@ module Contrast
 
             relationship = tag.compare_range(range.start_idx, range.end_idx)
             case relationship
-            when Contrast::Agent::Assess::Tag::BELOW
               # since the tags are ordered, if we're below, nope out
-              return false
-            when Contrast::Agent::Assess::Tag::LOW_SPAN
-              # if we ever get a low span, that means a low part
-              # won't be covered. there's no need to continue
-              return false
-            when Contrast::Agent::Assess::Tag::WITHOUT
-              # if we ever get a without, that means a low part won't
-              # be covered. there's no need to continue
+            when Contrast::Agent::Assess::Tag::BELOW,
+                # if we ever get a low span, that means a low part
+                # won't be covered. there's no need to continue
+                Contrast::Agent::Assess::Tag::LOW_SPAN,
+                # if we ever get a without, that means a low part won't
+                # be covered. there's no need to continue
+                Contrast::Agent::Assess::Tag::WITHOUT
+
               return false
             when Contrast::Agent::Assess::Tag::WITHIN
               # if we're within, then 0 out this tag since it is
@@ -37,7 +38,9 @@ module Contrast
               tag.update_end(0)
             when Contrast::Agent::Assess::Tag::HIGH_SPAN
               tag.update_start(range.end_idx)
-            when Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/EmptyWhen
+            when Contrast::Agent::Assess::Tag::ABOVE
+              # The tag's above where we are, it doesn't cover us but a later
+              # one may
             end
           end
           return false unless tag.length <= 0
@@ -53,34 +56,34 @@ module Contrast
         # Any overlapping ranges are merged before returning
         #
         # arr: the array of tags to which we are adding
-        # new_arr: misnomer. either an array of or a single Tag to be added
-        def ordered_merge arr, new_arr
+        # add_arr:  array of Tags or a single Tag to be added
+        def ordered_merge arr, add_arr
           # [Contrast::Agent::Assess::Tag, ...]
-          if new_arr.is_a?(Array)
-            return arr unless new_arr.any?
-            return new_arr unless arr&.any?
+          if add_arr.is_a?(Array)
+            return arr unless add_arr.any?
+            return add_arr unless arr&.any?
 
-            new_arr.each { |new_element| single_ordered_merge(arr, new_element) }
+            add_arr.each { |new_element| single_ordered_merge(arr, new_element) }
           # Contrast::Agent::Assess::Tag
           else
-            return arr unless new_arr
-            return [new_arr] unless arr
+            return arr unless add_arr
+            return [add_arr] unless arr
 
-            single_ordered_merge(arr, new_arr)
+            single_ordered_merge(arr, add_arr)
           end
           smallerize(arr)
         end
 
         # Given a collection of tags, merge any tags that are continuous
         #
-        # If tags is a hash, it should be in the format label => [tags]
-        # The array of tags will each be merged
+        # If tags is a hash, it should be in the format label => [tags]. The array of tags will each be merged
+        # If tags is an array in the format [tags], the array will be merged
         #
-        # If tags is an array in the format [tags], the array will be
-        # merged
+        # The original object is returned, although setters should not be necessary since tags is a collection in
+        # either case
         #
-        # The original object is returned, although setters should not be
-        # necessary since tags is a collection in either case
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
         def merge_tags tags
           if tags.is_a?(Hash)
             tags.each_value { |value| smallerize(value) }
@@ -89,22 +92,34 @@ module Contrast
           end
         end
 
+        # Merge the given set of tags such that any overlap combines. For any tag which extends beyond the size of the
+        # target_object, the end will be updated to the target_object's length.
+        #
+        # @param target_object [Object] the thing to which the tags apply
+        # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        # @return [Hash{String => Array<Contrast::Agent::Assess::Tag>}, Array<Contrast::Agent::Assess::Tag>]
+        def size_aware_merge target_object, tags
+          max_size = target_object.to_s.length
+          tags = merge_tags(tags)
+          tags.each do |tag|
+            tag.update_end(max_size) if tag.extends_beyond_string_size?(max_size)
+          end
+        end
+
         private
 
-        # Add one new element to the given array
-        #
-        # The addition is done such that the new entry(ies)
-        # are inserted so that the range they cover is in order
-        # Any overlapping ranges are merged before returning
+        # Add one new element to the given array. The addition is done such that the new entry is inserted so that the
+        # range they cover is in order. Any overlapping ranges are merged before returning.
         #
-        # arr: the array to which the element is added
-        # new_element: the element to be added to the array
+        # @param arr [Array<Contrast::Agent::Assess::Tag>]
+        # @param new_element []Contrast::Agent::Assess::Tag]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def single_ordered_merge arr, new_element
           idx = 0
           arr.each do |existing|
             break unless existing.start_idx < new_element.start_idx
 
-            if existing.overlaps?(new_element)
+            if existing.overlaps?(new_element.start_idx, new_element.end_idx)
               existing.merge(new_element)
               return # rubocop:disable Lint/NonLocalExitFromIterator
             end
@@ -113,18 +128,17 @@ module Contrast
           arr.insert(idx, new_element)
         end
 
-        # Given an arry of tags, merge any that overlap
-        # The tag that was higher up is removed from the
-        # list of tags.
-        # ranges like [0-3][3-6]-6-9] that should become [0-9]
+        # Given an arry of tags, merge any that overlap. The tag that was higher up is removed from the list of tags.
+        # ranges like [0-3][3-6]-6-9] become [0-9]
+        #
+        # @param tags [Array<Contrast::Agent::Assess::Tag>]
+        # @return [Array<Contrast::Agent::Assess::Tag>]
         def smallerize tags
           smallered = []
           curr = nil
+          tags.sort_by! { |tag| [tag.start_idx, tag.end_idx] }
           tags.each do |tag|
-            if curr.nil?
-              curr = tag
-              smallered << curr
-            elsif tag.start_idx <= curr.end_idx
+            if curr && tag.start_idx <= curr.end_idx
               curr.update_end(tag.end_idx) if tag.end_idx > curr.end_idx
             else
               curr = tag

data/lib/contrast/utils/thread_tracker.rb

@@ -1,54 +1,58 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
-    # ThreadTracker allows tracking of singleton objects across threads
+    # ThreadTracker allows tracking of singleton objects across threads. It acts on Thread#[] as that call is
+    # fiber-local where as Thread#thread_variables is not.
     class ThreadTracker
-      def initialize logger = nil
-        @logger = logger
-      end
-
-      # Note about Ruby -- thread#[] is fiber-local,
-      # #thread_variables is not.
-
+      # Get the given key to given value in Thread#[] or return default.
+      #
+      # @param key [Object] key used to reference the value
+      # @param default [Object] value to return if not present in Thread#[]
+      # @return [Object]
       def get key, default = nil
-        log(key)
         Thread.current[key] || default
       end
 
+      # Set the given key to given value in Thread#[].
+      #
+      # @param key [Object] key used to reference the value
+      # @param value [Object] value to store
       def set key, value
         Thread.current[key] = value
       end
 
+      # Remove the given key from the current Thread#[] by setting it to nil.
+      #
+      # @param key [Object] key of the value to delete
       def delete key
         Thread.current[key] = nil
       end
 
-      def lifespan obj
-        set(:current_context, obj)
-        response = yield(obj)
+      # Wrap the block given with a RequestContext by setting it beforehand and deleting it after.
+      #
+      # @param context [Contrast::Agent::RequestContext]
+      def lifespan context
+        set(:current_context, context)
+        response = yield(context)
         delete(:current_context)
         response
       end
 
+      # Retrieve the Thread#[] RequestContext
+      #
+      # @return [Contrast::Agent::RequestContext]
       def current
         get(:current_context)
       end
 
+      # Set the Thread#[] context to the one provided.
+      #
+      # @param context [Contrast::Agent::RequestContext]
       def update_current_context context
         set(:current_context, context)
       end
-
-      # logger may be nil so use this utility method instead
-      def log key, msg = nil
-        return unless @logger
-        return unless @logger.debug?
-
-        @logger.debug("Thread Tracker[#{ key }] :: #{ Process.pid }.#{ Thread.current.object_id } => #{ msg }")
-      rescue StandardError
-        false # NOOP
-      end
     end
   end
 end

data/lib/contrast/utils/timer.rb

@@ -1,77 +1,42 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
   module Utils
     # Timer is class that can track state about when an event starts and how long it takes
-    # Also containes utility methods to get time values in milliseconds
+    # Also contains utility methods to get time values in milliseconds
     class Timer
-      attr_reader :start_at, :start_ms, :events
+      # @return [Integer] the ms of the Time that this instance represents
+      attr_reader :start_ms
 
+      # Create a wrapper for the current time
+      #
+      # @param time [Time]
       def initialize time = Time.now
         @start_at = time
         @start_ms = (@start_at.to_f * 1000).to_i
         @events = {}
       end
 
-      def elapsed label
-        before = Time.now
-        result = yield if block_given?
-        events[label.to_s] = ((Time.now - before) * 1000).to_i
-        result
-      end
-
-      def ms key
-        events[key.to_s] || 0
-      end
-
-      def abs key
-        start_ms + (events[key.to_s] || 0)
-      end
-
-      def to_s
-        pairs = events.to_a.map { |pair| "#{ pair[0] }=#{ pair[1] }ms" }
-        start_at.strftime('%Y-%m-%d %H:%M:%S.%L') + pairs.join(Contrast::Utils::ObjectShare::SPACE)
-      end
-
-      def diff_s start_ms
-        (now_ms - start_ms) / 1000
-      end
-
-      def now_ms
-        (Time.now.to_f * 1000).to_i
-      end
-
+      # @return [Integer] time, in ms
       def self.now_ms
         (Time.now.to_f * 1000).to_i
       end
 
-      def self.earliest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].min
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def self.latest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].max
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def now_sec
-        now_ms / 1000
+      # Return current time in iso8601 format.
+      #
+      # @return[String]
+      def self.time_now
+        Time.now.utc.iso8601(7)
       end
 
-      def elapsed_ms
-        now_ms - start_ms
+      # Converts time given in ms format form TS to HttpDate.
+      # Returns time format for If-Modified-Since: <day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
+      # Note: The Time class treats GMT (Greenwich Mean Time) and UTC (Coordinated Universal Time) as equivalent.
+      #
+      # @param time [Integer] time in ms.
+      def self.ms_to_httpdate time
+        Time.at(time / 1000).httpdate unless time.nil?
       end
     end
   end

data/lib/contrast-agent.rb

@@ -1,8 +1,8 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # We need this to make bundler happy since it's the name of the gem, unless we
 # want to go through the trouble of renaming to contrast_agent.gem, which we
 # shouldn't do until we're ready to go to RubyGems
 
-require_relative './contrast' # rubocop:disable  Kernel/RequireRelative
+require_relative './contrast'

data/lib/contrast.rb

@@ -1,57 +1,120 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# Top-level namespace for Contrast Security agent
-module Contrast
-end
+# Used to prevent deprecation warnings from flooding stdout
+ENV['PB_IGNORE_DEPRECATIONS'] = 'true'
 
-# Some developers override various methods on Object, which can often involve
-# changing expected method parity/behavior which in turn prevents us from being
-# able to reliably use affected methods.
-# We alias these method so that we always have access to them.
-#
-# Because we use these methods in constructing classes (e.g., calling #freeze
-# on constants within class definitions) we do this aliasing ASAP.
-class Object
-  alias_method :cs__class, :class
-  alias_method :cs__freeze, :freeze
-  alias_method :cs__frozen?, :frozen?
-  alias_method :cs__is_a?, :is_a?
-  alias_method :cs__method, :method
-  alias_method :cs__respond_to?, :respond_to?
-  alias_method :cs__singleton_class, :singleton_class
-end
+require 'contrast/extension/object'
+
+# ActiveRecord gives access to the `String#blank?` method, which we've started using. We need to make sure that method
+# actually exists.
+# From https://github.com/rails/rails/blob/main/activesupport/lib/active_support/core_ext/object/blank.rb
+class String
+  unless cs__respond_to?(:blank?)
 
-require_relative './contrast/agent/require_state' # rubocop:disable  Kernel/RequireRelative
+    CS__BLANK_RE = /\A[[:space:]]*\z/.cs__freeze
+    # A string is blank if it's empty or contains whitespaces only:
+    #
+    #   ''.blank?       # => true
+    #   '   '.blank?    # => true
+    #   "\t\n\r".blank? # => true
+    #   ' blah '.blank? # => false
+    #
+    # Unicode whitespace is supported:
+    #
+    #   "\u00a0".blank? # => true
+    #
+    # @return [true, false]
+    def blank?
+      # The regexp that matches blank strings is expensive. For the case of empty
+      # strings we can speed up this method (~3.5x) with an empty? call. The
+      # penalty for the rest of strings is marginal.
+      empty? ||
+          begin
+            CS__BLANK_RE.match?(self)
+          rescue Encoding::CompatibilityError
+            false
+          end
+    end
+  end
+end
 
-# We have to do this here BEOFRE we require anything b/c we can't use the
-# Contrast require methods without it.
-module Kernel
-  def cs__scoped_require path
-    Contrast::Agent::RequireStates.enter
-    require(path) # rubocop:disable  Kernel/Require
-  ensure
-    Contrast::Agent::RequireStates.exit
+if RUBY_VERSION >= '3.0.0' && RUBY_VERSION < '3.1.0'
+  # This fixes Ruby 3.0 issues with Module#(some instance method) patching by preventing the prepending of
+  # a JSON helper on protobuf load. String.instance_method(:+) is one of the most noticeable.
+  # This is fixed in Ruby 3.1.0
+  # TODO: RUBY-1132 Remove this once Ruby 3 support is dropped.
+  # See bug here: https://bugs.ruby-lang.org/issues/17725
+  class Class
+    alias_method(:cs__orig_prepend, :prepend)
+    def prepend other
+      include(other)
+    end
   end
 end
 
-# component interface for class creation
-# config gets built as a consequence of this require
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/assess'
+require 'contrast/components/config'
+require 'contrast/components/logger'
+require 'contrast/components/protect'
+require 'contrast/components/sampling'
+require 'contrast/components/scope'
+require 'contrast/components/settings'
+require 'contrast/utils/routes_sent'
+require 'contrast/agent/telemetry/hash'
+require 'contrast/agent/telemetry/telemetry'
+require 'contrast/agent/telemetry/exception/event'
+require 'contrast/agent_lib/interface'
+
+module Contrast # :nodoc:
+  CONFIG = Contrast::Components::Config::Interface.new
+  SCOPE = Contrast::Components::Scope::Interface.new
+  APP_CONTEXT = CONFIG.application
+  API = CONFIG.api
+  SETTINGS = Contrast::Components::Settings::Interface.new
+  ASSESS = CONFIG.assess
+  PROTECT = Contrast::Components::Protect::Interface.new
+  INVENTORY = CONFIG.inventory
+  AGENT = CONFIG.agent
+  RUBY_INTERFACE = AGENT.ruby
+  LOGGER = AGENT.logger
+  AGENT_LIB = Contrast::AgentLib::Interface.new
+end
 
-# shared configuration support
-cs__scoped_require 'contrast/config'
-cs__scoped_require 'contrast/configuration'
+module Contrast
+  TELEMETRY_EXCEPTIONS = (Contrast::Agent::Telemetry::Hash.new if Contrast::Agent::Telemetry.exceptions_enabled?)
+  ROUTES_SENT = Contrast::Utils::RoutesSent.new
+end
 
-cs__scoped_require 'contrast/agent/version'
+# This needs to be required very early, after component interfaces, and before instrumentation attempts
+require 'contrast/funchook/funchook'
 
-# errors and exceptions
-cs__scoped_require 'contrast/security_exception'
-cs__scoped_require 'contrast/internal_exception'
+require 'contrast/agent/version'
 
 # shared utils
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/utils/random_util'
-cs__scoped_require 'contrast/utils/preflight_util'
+require 'contrast/utils/timer'
+
+require 'contrast/utils/assess/sampling_util'
+require 'contrast/agent'
+
+if RUBY_VERSION >= '3.0.0' && RUBY_VERSION < '3.1.0'
+  # Put prepend back as it was.
+  Class.alias_method(:prepend, :cs__orig_prepend)
+  Class.remove_method(:cs__orig_prepend)
+end
+
+if RUBY_VERSION < '3.0.0'
+  # Better handles ancestors for older ruby versions.
+  # This is called from C, tread lightly.
+  class Module
+    @_included_in = []
+    # Returns array with modules including this instance
+    def included_in
+      @_included_in ||= [] unless cs__frozen?
+    end
 
-cs__scoped_require 'contrast/agent'
+    def self.included_in
+      @_included_in ||= [] unless cs__frozen?
+    end
+  end
+end