contrast-agent 4.1.0 → 4.4.0

data/lib/contrast/agent/static_analysis.rb

@@ -17,14 +17,9 @@ module Contrast
         # report the already-loaded gems.
         def catchup
           @_catchup ||= begin
-            with_contrast_scope do
-              Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.catchup
-              send_inventory_message
-              true
-            end
+            threaded_analysis!
+            true
           end
-        rescue StandardError => e
-          logger.warn('Unable to run post-initialization static analysis', e)
         end
 
         def send_inventory_message
@@ -35,6 +30,17 @@ module Contrast
           Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
           Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
         end
+
+        private
+
+        def threaded_analysis!
+          Contrast::Agent::Thread.new do
+            Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.catchup
+            send_inventory_message
+          rescue StandardError => e
+            logger.warn('Unable to run post-initialization static analysis', e)
+          end
+        end
       end
     end
   end

data/lib/contrast/agent/thread.rb

@@ -5,7 +5,7 @@ require 'contrast/components/interface'
 
 module Contrast
   module Agent
-    # Threads used by Contrast.
+    # Threads used by Contrast. Any long running thread should be created and managed by our ThreadWatcher class.
     class Thread < ::Thread
       include Contrast::Components::Interface
 

data/lib/contrast/agent/thread_watcher.rb

@@ -3,22 +3,31 @@
 
 require 'contrast/components/interface'
 require 'contrast/agent/service_heartbeat'
+require 'contrast/api/communication/messaging_queue'
 
 module Contrast
   module Agent
     # This class used to ensure that our worker threads are running in multi-process environments
+    #
+    # @attr_reader heapdump_util [Contrast::Utils::HeapDumpUtil]
+    # @attr_reader heartbeat [Contrast::Agent::ServiceHeartbeat]
+    # @attr_reader messaging_queue [Contrast::Api::Communication::MessagingQueue]
     class ThreadWatcher
       include Contrast::Components::Interface
-      access_component :logging
+      access_component :agent, :logging
 
-      attr_reader :heartbeat
+      attr_reader :heapdump_util, :heartbeat, :messaging_queue
 
       def initialize
         @pids = {}
+        @heapdump_util = Contrast::Utils::HeapDumpUtil.new
         @heartbeat = Contrast::Agent::ServiceHeartbeat.new
+        @messaging_queue = Contrast::Api::Communication::MessagingQueue.new
       end
 
       def startup!
+        return unless AGENT.enabled?
+
         unless heartbeat.running?
           logger.debug('Attempting to start heartbeat thread')
           heartbeat.start_thread!
@@ -26,11 +35,11 @@ module Contrast
         heartbeat_result = heartbeat.running?
         logger.debug('Heartbeat thread status', alive: heartbeat_result)
 
-        unless Contrast::Agent.messaging_queue.running?
+        unless messaging_queue.running?
           logger.debug('Attempting to start messaging queue thread')
-          Contrast::Agent.messaging_queue.start_thread!
+          messaging_queue.start_thread!
         end
-        messaging_result = Contrast::Agent.messaging_queue.running?
+        messaging_result = messaging_queue.running?
         logger.debug('Messaging thread status', alive: messaging_result)
 
         logger.debug('ThreadWatcher started threads')
@@ -44,6 +53,12 @@ module Contrast
         logger.debug('ThreadWatcher - threads not running')
         startup!
       end
+
+      def shutdown!
+        heartbeat.stop!
+        messaging_queue.stop!
+        heapdump_util.stop!
+      end
     end
   end
 end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '4.1.0'
+    VERSION = '4.4.0'
   end
 end

data/lib/contrast/api/communication/messaging_queue.rb

@@ -10,7 +10,7 @@ module Contrast
       # Top level gateway to messaging with speedracer
       class MessagingQueue < Contrast::Agent::WorkerThread
         include Contrast::Components::Interface
-        access_component :analysis, :logging, :settings
+        access_component :agent, :analysis, :logging, :settings
 
         attr_reader :queue, :speedracer
 
@@ -22,11 +22,19 @@ module Contrast
 
         # Use this to bypass the messaging queue and leave response processing to the caller
         def send_event_immediately event
-          send_event(event, true)
+          if AGENT.disabled?
+            logger.warn('Attempted to send event immediately with Agent disabled', caller: caller, event: event)
+            return
+          end
+          speedracer.return_response(event)
         end
 
         # Use this to add a message to the queue and process the response internally
         def send_event_eventually event
+          if AGENT.disabled?
+            logger.warn('Attempted to queue event with Agent disabled', caller: caller, event: event)
+            return
+          end
           logger.debug('Enqueued event for sending', event_type: event.cs__class)
           queue << event if event
         end
@@ -35,13 +43,14 @@ module Contrast
           speedracer.ensure_startup!
           return if running?
 
+          @queue ||= Queue.new
           @_thread = Contrast::Agent::Thread.new do
             loop do
               event = queue.pop
 
               begin
                 logger.debug('Dequeued event for sending', event_type: event.cs__class)
-                send_event(event)
+                speedracer.process_internally(event)
               rescue StandardError => e
                 logger.error('Could not send message to service from messaging queue thread.', e)
               end
@@ -50,25 +59,13 @@ module Contrast
           logger.debug('Started background sending thread.')
         end
 
-        private
+        def stop!
+          return unless running?
 
-        # return_response is used to determine if we want to return the response to the caller or process it internally
-        def send_event event, return_response = false
-          preprocess_event(event)
-          if return_response
-            speedracer.return_response(event)
-          else
-            speedracer.process_internally(event)
-          end
-        end
-
-        # For now this only handles appending assess tags
-        # eventually we could break out preprocessors for every event type
-        def preprocess_event event
-          return unless event.is_a?(Contrast::Api::Dtm::Activity)
-
-          # See if they're even enabled
-          event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
+          super
+          @queue&.clear
+          @queue&.close
+          @queue = nil
         end
       end
     end

data/lib/contrast/api/communication/response_processor.rb

@@ -11,6 +11,7 @@ module Contrast
         include Contrast::Components::Interface
         access_component :agent, :analysis, :logging, :settings
 
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process response
           logger.debug('Received a response', sent_ms: response&.sent_ms)
 
@@ -31,8 +32,10 @@ module Contrast
 
         private
 
-        # Given some protobuf messages, update settings.
+        # Given some protobuf messages, update server features.
         # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_server_response response
           server_features = response&.server_features
           return unless server_features
@@ -44,6 +47,10 @@ module Contrast
           server_features
         end
 
+        # Given some protobuf messages, update application settings.
+        # This is the bridge between Contrast Service <-> Settings.
+        #
+        # @param response [Contrast::Api::Settings::AgentSettings]
         def process_application_response response
           app_settings = response&.application_settings
           return unless app_settings

data/lib/contrast/api/communication/socket_client.rb

@@ -26,6 +26,7 @@ module Contrast
         #
         # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
         #   Contrast::Api::Dtm::Message
+        # @return [Contrast::Api::Settings::AgentSettings]
         def send_one event
           msg = Contrast::Api::Dtm::Message.build(event)
           send_message(msg)
@@ -58,24 +59,31 @@ module Contrast
           end
 
           # Or something is not set.
-          msg = if CONFIG.root.agent.service.host
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.port` is not set. ' \
-                  'Falling back to default TCP socket port.'
-                elsif CONFIG.root.agent.service.port
-                  'Missing a required connection value to the Contrast Service. ' \
-                  '`agent.service.host` is not set. ' \
-                  'Falling back to default TCP socket host.'
-                else
-                  'Missing a required connection value to the Contrast Service. ' \
-                  'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
-                  'Falling back to default TCP socket.'
-                end
-          logger.warn(msg,
+          logger.warn(log_connection_error_msg,
                       host: CONTRAST_SERVICE.host,
                       port: CONTRAST_SERVICE.port)
         end
 
+        # If our connection isn't built properly, we need to warn the user. This builds out the context specific
+        # message to provide that warning
+        #
+        # @return [String]
+        def log_connection_error_msg
+          if CONFIG.root.agent.service.host
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.port` is not set. ' \
+            'Falling back to default TCP socket port.'
+          elsif CONFIG.root.agent.service.port
+            'Missing a required connection value to the Contrast Service. ' \
+            '`agent.service.host` is not set. ' \
+            'Falling back to default TCP socket host.'
+          else
+            'Missing a required connection value to the Contrast Service. ' \
+            'Neither `agent.service.socket` nor the pair of `agent.service.host` and `agent.service.port` are set. '\
+            'Falling back to default TCP socket.'
+          end
+        end
+
         def send_message msg
           return unless msg
 

data/lib/contrast/api/decorators.rb

@@ -10,6 +10,8 @@ module Contrast
 end
 
 require 'contrast/api/decorators/message'
+require 'contrast/api/decorators/agent_startup'
+require 'contrast/api/decorators/application_startup'
 require 'contrast/api/decorators/application_update'
 require 'contrast/api/decorators/input_analysis'
 require 'contrast/api/decorators/application_settings'

data/lib/contrast/api/decorators/agent_startup.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the AgentStartup protobuf model to handle reporting Agent process start
+      module AgentStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :analysis, :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration and Agent discovery
+          #
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @parma name [String] the Hostname of this Server, or overridden value, used to identify this process
+          # @return [Contrast::Api::Dtm::AgentStartup]
+          def build name, path, type
+            msg = new
+            msg.server_version   = Contrast::Agent::VERSION
+            msg.server_name      = Contrast::Utils::StringUtils.protobuf_format name
+            msg.server_path      = Contrast::Utils::StringUtils.protobuf_format path
+            msg.server_type      = Contrast::Utils::StringUtils.protobuf_format type
+            config!(msg)
+            msg.finding_tags = Contrast::Utils::StringUtils.protobuf_format ASSESS.tags
+            msg
+          end
+
+          private
+
+          # set the configuration driven values for this AgentStartup msg
+          #
+          # @param msg [Contrast::Api::Dtm::AgentStartup]
+          def config! msg
+            msg.version          = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+            msg.environment      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+            msg.server_tags      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
+            msg.application_tags = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+            msg.library_tags     = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.inventory.tags
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::AgentStartup.include(Contrast::Api::Decorators::AgentStartup)

data/lib/contrast/api/decorators/application_startup.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/api/dtm.pb'
+require 'contrast/components/interface'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationCreate protobuf model to handle reporting Agent process start
+      module ApplicationStartup
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the AgentStartup class on inclusion of the decorator
+        module ClassMethods
+          # Return a new DTM with the values from the configuration
+          #
+          # @return [Contrast::Api::Dtm::ApplicationCreate]
+          def build
+            msg = new
+            msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
+            msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
+            msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+            msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
+            session!(msg)
+            msg
+          end
+
+          private
+
+          # Set the session metadata for this ApplicationCreate msg
+          #
+          # @param msg [Contrast::Api::Dtm::ApplicationCreate]
+          def session! msg
+            msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
+            msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationCreate.include(Contrast::Api::Decorators::ApplicationStartup)

data/lib/contrast/api/decorators/library.rb

@@ -13,6 +13,7 @@ module Contrast
         def self.included klass
           klass.extend(ClassMethods)
         end
+
         # Used to add class methods to the Library class on inclusion of the decorator
         module ClassMethods
           def build digest, gem_specification

data/lib/contrast/api/decorators/library_usage_update.rb

@@ -11,6 +11,7 @@ module Contrast
         def self.included klass
           klass.extend(ClassMethods)
         end
+
         # Used to add class methods to the LibraryUsageUpdate class on inclusion of the decorator
         module ClassMethods
           def build digest, files

data/lib/contrast/api/decorators/route_coverage.rb

@@ -26,27 +26,37 @@ module Contrast
           end
 
           # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          #
           # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @param url [String, nil] use url from string instead of journey object.
           # @return [Contrast::Api::Dtm::RouteCoverage]
-          def from_action_dispatch_journey journey_obj
+          def from_action_dispatch_journey journey_obj, url = nil
             msg = new
             msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
 
             verb = source_or_string(journey_obj.verb)
             msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
 
-            url = source_or_string(journey_obj.path.spec)
+            url ||= source_or_string(journey_obj.path.spec)
             msg.url = Contrast::Utils::StringUtils.force_utf8(url)
             msg
           end
 
-          def from_sinatra_route clazz, method, pattern
+          # Convert Sinatra route data to dtm message.
+          #
+          # @param controller [::Sinatra::Base] the route's final controller.
+          # @param method [String] GET, PUT, POST, etc...
+          # @param method [::Mustermann::Sinatra]  the pattern that was matched in routing.
+          # @param url [String, nil] use url from string instead matched pattern.
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_sinatra_route controller, method, pattern, url = nil
             safe_pattern = source_or_string(pattern)
+            safe_url = source_or_string(url || pattern)
 
             msg = new
-            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.route = "#{ controller }##{ method } #{ safe_pattern }"
             msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
-            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_url)
             msg
           end
         end